A flaw was found in redis-parser. This vulnerability allows a malicious or compromised Redis endpoint to trigger an uncaught RangeError by sending a crafted RESP (REdis Serialization Protocol) header with an excessively large declared length. The flaw occurs because redis-parser fails to validate the multi-bulk length value during RESP protocol parsing. Successful exploitation can lead to a Denial of Service (DoS) by crashing the Node.js client process.
Last checked: 2026-09-24 21:23 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-24 15:31 UTC)
Fix evidence last checked: 2026-10-22 17:12 UTC