Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-93435

redis-parser through 3.0.0 Denial of Service via Unbounded Recursion

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the V8 call stack, causing an uncaught RangeError that terminates the Node.js process without triggering error handling callbacks.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Noderedis
Products
Redis-parser
CVE-2026-97057

redis-parser through 3.0.0 Denial of Service via Invalid Array Length

redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Noderedis
Products
Redis-parser