CVE-2026-93435: redis-parser through 3.0.0 Denial of Service via Unbounded Recursion
redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the V8 call stack, causing an uncaught RangeError that terminates the Node.js process without triggering error handling callbacks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using redis-parser versions through 3.0.0 are affected when the client parses RESP data from a malicious Redis endpoint.
What does an attacker need to do to trigger the denial of service?
An attacker needs to send a crafted RESP byte stream containing repeatedly nested array headers. The CVSS vector indicates no privileges or user interaction are required.
How does the failure appear in an affected Node.js application?
The nested arrays exhaust the V8 call stack and cause an uncaught RangeError. The Node.js process terminates without invoking error-handling callbacks.