CVE-2025-7074 - CVE House

Back to Database

Status published Medium CVE-2025-7074

vercel hyper rimraf-standalone.js ignoreMap redos

5.3 CVSS

Vulnerability Description

A vulnerability classified as problematic has been found in vercel hyper up to 3.4.1. This affects the function expand/braceExpand/ignoreMap of the file hyper/bin/rimraf-standalone.js. The manipulation leads to inefficient regular expression complexity. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-7074

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

DayShift (VulDB User)

References

More from vercel

View All →

A denial of service vulnerability exists in Next.js versions with...

A denial of service vulnerability exists in self-hosted Next.js applications...

Next.js Improper Middleware Redirect Handling Leads to SSRF

Next.js Affected by Cache Key Confusion for Image Optimization API Routes

Next.js Content Injection Vulnerability for Image Optimization

Affected Vendor

vercel

View all reports →

Affected Software

hyper

Vulnerable Versions:

3.4.0, 3.4.1

Timeline

Official Publish: July 5th, 2025

Last Modified: July 7th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R

Weaknesses (CWE)

CWE-1333 CWE-400

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service

T1190 Exploit Public-Facing Application

T1496 Resource Hijacking

T1562 Impair Defenses

Defense Evasion

T1070 Indicator Removal on Host

Defense Evasion

T1498 Network Denial of Service