CVE-2026-97057: redis-parser through 3.0.0 Denial of Service via Invalid Array Length
redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Node.js applications using npm/redis-parser through version 3.0.0 are exposed when they parse responses from a malicious or compromised Redis endpoint. The issue is triggered by a crafted RESP multi-bulk header declaring a length greater than 2^32-1.
What does an attacker need to do to exploit the issue?
The attacker needs to cause the client to receive a crafted RESP response from a Redis endpoint, with an excessively large declared multi-bulk length. No authentication or user interaction is required according to the supplied severity vector.
What is the observable impact on an affected application?
Parsing the crafted header causes an uncaught RangeError, which can crash the Node.js client process. The reported impact is denial of service; no confidentiality or integrity impact is indicated.