Redis Parser
Monthly
Denial of service in NodeRedis redis-parser through 3.0.0 lets a hostile or hijacked Redis endpoint crash the Node.js client process by returning a crafted RESP multi-bulk header whose declared length exceeds 2^32-1, triggering an uncaught RangeError during parsing. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N) but its impact is strictly availability (VA:H) - no confidentiality, integrity, or scope impact - so a malicious server, a compromised legitimate Redis instance, or an on-path injector in the RESP response stream can only take down the parsing process. Rated 8.7 (HIGH) by CVSS 4.0, with no public exploit identified at time of analysis and no confirmed vendor-released patch, though the issue is publicly tracked upstream.
Denial of service in NodeRedis redis-parser through 3.0.0 lets a hostile or hijacked Redis endpoint crash the Node.js client process by returning a crafted RESP multi-bulk header whose declared length exceeds 2^32-1, triggering an uncaught RangeError during parsing. The flaw is reachable by unauthenticated remote attackers (CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N) but its impact is strictly availability (VA:H) - no confidentiality, integrity, or scope impact - so a malicious server, a compromised legitimate Redis instance, or an on-path injector in the RESP response stream can only take down the parsing process. Rated 8.7 (HIGH) by CVSS 4.0, with no public exploit identified at time of analysis and no confirmed vendor-released patch, though the issue is publicly tracked upstream.