Denial of Service in redis-parser by Redis LLC

CVE-2026-93435

What is CVE-2026-93435?

The redis-parser version 3.0.0 and earlier versions contain a denial of service vulnerability in the RESP protocol parser. This flaw allows malicious Redis endpoints to exploit the client process through unbounded recursion caused by specially crafted RESP byte streams with repeated array headers. When encountered, this vulnerability can exhaust the V8 call stack, leading to an uncaught RangeError that terminates the Node.js process abruptly, bypassing standard error handling mechanisms. Users are encouraged to monitor their Redis connections for unusual activity and upgrade accordingly to mitigate the risks associated with this vulnerability.

References