GCVE-110-MAGEIA-2025-194 — Vulnetix

GCVE-110-MAGEIA-2025-194

Advisory Published

Vulnetix · Advisory published June 25, 2025

CVE-2024-37890 yarnpkg: denial of service when handling a request with many HTTP headers. CVE-2024-48949 yarnpkg: Missing Validation in Elliptic's EDDSA Signature Verification. CVE-2024-12905 yarnpkg: link following and path traversal via maliciously crafted tar file And other vulnerabilities in the yarn's bundled nodejs components are fixed too, see the references.

Download JSON Open in Console

Affected Products

Vendor	Product	Versions	Platforms
Mageia	yarnpkg	0 (affected), 1.22.22-0.10.9.2.1.mga9 (unaffected)	—

Aliases

CVE-2020-7677 CVE-2021-43138 CVE-2022-3517 CVE-2022-37599 CVE-2023-26136 CVE-2023-46234 CVE-2024-12905 CVE-2024-37890 CVE-2024-4067 CVE-2024-48949 CVE-2025-48387

References

Updated yarnpkg packages fix security vulnerabilities

advisory

Updated yarnpkg packages fix security vulnerabilities

issue

Updated yarnpkg packages fix security vulnerabilities

issue

Updated yarnpkg packages fix security vulnerabilities

issue

Browse GCVE Records

74,108 records in the GCVE database · Updated July 20, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON

$ Console Community · 100/wk Open console ›