CVE-2025-7074: vercel hyper rimraf-standalone.js ignoreMap redos

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2025-07-05 · updated 2026-06-17
Weakness: CWE-400

Description

A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Affected products

vercel hyper: through 3.4.1

References

https://github.com/vercel/hyper/issues/8098
https://vuldb.com/?ctiid.314973
https://vuldb.com/?id.314973
https://vuldb.com/?submit.602353
https://github.com/vercel/hyper/issues/8098

Get alerted when CVE-2025-7074 or the next vulnerability affects your stack