CVE-2026-93435CWE-674

CVE-2026-93435

High · published September 18, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the V8 call stack, causing an uncaught RangeError that terminates the Node.js process without triggering error handling callbacks.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00684 · 52.0th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-09-18T03:18Z
References (6)
https://github.com/NodeRedis/node-redis-parser · [email protected]https://github.com/NodeRedis/node-redis-parser/blob/701655430f5f7d9ca00892a02f7eefcbc1193a98/lib/parser.js#L204-L213 · [email protected]https://github.com/NodeRedis/node-redis-parser/blob/701655430f5f7d9ca00892a02f7eefcbc1193a98/lib/parser.js#L291-L306 · [email protected]https://github.com/NodeRedis/node-redis-parser/issues/66 · [email protected]https://github.com/redis/ioredis/issues/2108 · [email protected]https://www.vulncheck.com/advisories/redis-parser-through-3.0.0-denial-of-service-via-unbounded-recursion · [email protected]
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 22:15Z
    redis-parser through 3.0.0 Denial of Service via Unbounded Recursion
    cvelistv5