HIGH
NodeRedis
CVE published 2026-09-17
CVE-2026-93435
A denial of service vulnerability exists in redis-parser through 3.0.0 in the RESP protocol parser. Malicious Redis endpoints can crash the client process through unbounded recursion on nested arrays by sending crafted RESP byte streams with repeated array headers, exhausting the V8 call stack and causing an uncaught RangeError that terminates the Node.js process without triggering error handling callbacks.