Hi,

The following vulnerability was published for node-yarnpkg.

CVE-2025-8262[0]:
| A vulnerability was found in yarnpkg Yarn up to 1.22.22. It has been
| classified as problematic. Affected is the function
| explodeHostedGitFragment of the file src/resolvers/exotics/hosted-
| git-resolver.js. The manipulation leads to inefficient regular
| expression complexity. It is possible to launch the attack remotely.
| The patch is identified as 97731871e674bf93bcbf29e9d3258da8685f3076.
| It is recommended to apply a patch to fix this issue.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-8262
https://www.cve.org/CVERecord?id=CVE-2025-8262
[1] https://github.com/yarnpkg/yarn/pull/9199

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore