Denial of Service Vulnerability in Redis Parser by NodeRedis
CVE-2026-97057

8.7HIGH

Key Information:

Vendor

Noderedis

Status
Redis-parser
Vendor
CVE Published:
24 September 2026

What is CVE-2026-97057?

The redis-parser component by NodeRedis, up to version 3.0.0, contains a serious flaw in its RESP protocol parsing mechanism. This vulnerability arises due to a lack of validation for the multi-bulk length value. An attacker can exploit this issue by sending a crafted RESP header with an excessively large length parameter, potentially exceeding the maximum allowable value of 2^32-1. This action can lead to an uncontrolled RangeError, effectively crashing the Node.js client process that is handling the parsing. A compromised or malicious Redis endpoint could be used to trigger this vulnerability, resulting in denial of service for applications relying on this parsing library.

Affected Version(s)

redis-parser 0 <= 3.0.0

References

https://github.com/NodeRedis/node-redis-parser/issues/65
issue-tracking
https://github.com/NodeRedis/node-redis-parser/blob/4c2d3...
technical-description
https://github.com/NodeRedis/node-redis-parser/blob/4c2d3...
technical-description

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wayde Shi (PayPal Cyber Security Team)
.