Skip to content
OpenAdvisories

Package · Debian

node-yarnpkg

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.3
    CVE-2025-8262

    yarnpkg Yarn hosted-git-resolver.js explodeHostedGitFragment redos

    A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been classified as problematic. Affected is the function explodeHostedGitFragment of the file src/resolvers/exotics/hosted-git-resolver.js. The manipulation leads to inefficient regular expressio…

    yarnpkg Yarn node-yarnpkg node-yarnpkg Debian Ubuntu
  • Medium 5.9
    CVE-2019-15608

    TOCTOU Race Condition in Yarn

    The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.

    node-yarnpkg yarn Debian npm