redis-parser vulnerabilities

2 known vulnerabilities in redis-parser from NodeRedis. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  redis-parser: Improper Validation of Specified Quantity in Input

  CVE-2026-97057Sep 24, 2026NodeRedis

  redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a c

• 7.5 High severity

  redis-parser: Uncontrolled Recursion

  CVE-2026-93435Sep 17, 2026NodeRedis

  redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with