redis-parser CVE-2026-93435

Exploitation requires that the vulnerable Node.js application using redis-parser (≤3.0.0, including via node_redis/ioredis) connect to a Redis endpoint the attacker controls or can impersonate, then receive a crafted RESP reply built from repeated/nested array headers. This is a client-side parser crash, not a listening-service flaw: the limiting factor is that the victim must be induced to talk to a malicious or compromised Redis server (rogue endpoint, man-in-the-middle on an unencrypted connection, multi-tenant/untrusted Redis, or SSRF-style connection redirection). No authentication or user interaction is needed on the parsing path once the connection exists, and default configurations are affected because the recursion is unbounded regardless of settings; impact is limited to availability (process crash) with no confidentiality or integrity effect.

The single quantified signal is the vendor CVSS 4.0 base score of 8.7 (AV:N/AC:L/AT:N/PR:N/UI:N with VA:H and confidentiality/integrity at none), which correctly frames this as a pure availability/denial-of-service issue - no data exposure or code execution. No EPSS score, no CISA KEV listing, and no weaponized proof-of-concept are present in the input, so by the precision rules this is 'no public exploit identified at time of analysis'; the VulnCheck advisory is a technical writeup, not exploit code. The most important nuance that the raw score obscures is directionality: the attacker must operate a MALICIOUS or compromised Redis endpoint that the victim Node.js process connects to - this is a client-side parser crash, not a flaw in a network service listening for attackers. That inverts the usual 'internet-exposed listener' threat model and materially lowers real-world reachability, because most Node apps connect to trusted, self-hosted Redis rather than attacker-chosen endpoints. Where it does matter is untrusted/multi-tenant Redis, SSRF-style redirection to a rogue endpoint, or supply-chain scenarios. Net: a legitimately impactful availability bug given redis-parser's ubiquity in the Node ecosystem, but real-world priority is gated by whether the deployment can be induced to connect to an attacker-controlled Redis server. No conflicting signals, but note EPSS/KEV/POC data is simply absent rather than negative.

An attacker who controls or can impersonate a Redis endpoint (rogue server, MITM, or SSRF-redirected connection) returns a crafted RESP byte stream containing many repeated nested array headers. When the victim's Node.js client parses the reply, redis-parser recurses without bound, exhausts the V8 call stack, and throws an uncaught RangeError that terminates the process without firing the client's error callbacks. No authenticated proof-of-concept exploit is published; VulnCheck provides a technical advisory only.