CVE-2026-93435
Description
A flaw was found in node-redis-parser. A remote attacker, by sending crafted RESP (REdis Serialization Protocol) byte streams with repeated array headers, can exploit an unbounded recursion vulnerability in the RESP protocol parser. This can exhaust the V8 call stack, leading to an uncaught RangeError that terminates the Node.js process, resulting in a Denial of Service (DoS) for the client.
Statement
This vulnerability is rated as Important because an untrusted Redis server or network adversary can completely terminate the dependent Node.js client process, causing an unhandled denial of service. In typical Red Hat enterprise deployments, applications communicate with Redis instances over isolated internal networks with authentication, which limits direct exposure to malicious endpoints. The risk remains confined to application availability, as the resulting call stack exhaustion crashes the runtime without exposing data confidentiality or allowing system compromise.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU)
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
