CVE-2026-97057
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1.
Risk Assessment
This can crash the Node.js client process, leading to denial of service. It affects Node.js applications using redis-parser to communicate with Redis.
Recommendation
Update redis-parser to a version later than 3.0.0 once a fix is available. Consider validating Redis server responses or using trusted endpoints.
Other vulnerabilities in redis-parser
Original NVD description (English source)
redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS