CVE-2026-93435
redis-parser through 3.0.0 Denial of Service via Unbounded Recursion
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the V8 call stack, causing an uncaught RangeError that terminates the Node.js process without triggering error handling callbacks.
| CWE | CWE-674 |
| Vendor | noderedis |
| Product | redis-parser |
| Published | Sep 17, 2026 |
Stay Ahead of the Next One
Get instant alerts for noderedis redis-parser
Be the first to know when new high vulnerabilities affecting noderedis redis-parser are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
NodeRedis / redis-parser
0 ≤ 3.0.0
References
github.com: https://github.com/redis/ioredis/issues/2108 github.com: https://github.com/NodeRedis/node-redis-parser/blob/701655430f5f7d9ca00892a02f7eefcbc1193a98/lib/parser.js#L204-L213 github.com: https://github.com/NodeRedis/node-redis-parser/blob/701655430f5f7d9ca00892a02f7eefcbc1193a98/lib/parser.js#L291-L306 github.com: https://github.com/NodeRedis/node-redis-parser vulncheck.com: https://www.vulncheck.com/advisories/redis-parser-through-3.0.0-denial-of-service-via-unbounded-recursion
Credits
🔍 Wayde Shi (PayPal Cyber Security Team)