CyberRota Analysis
AI-GeneratedThe vulnerability affects the redis-parser library up to version 3.0.0, allowing attackers to exploit the RESP protocol parser by sending specially crafted byte streams that trigger unbounded recursion on nested arrays. This can lead to a denial of service by crashing the client process, as the V8 call stack is exhausted and the Node.js process terminates without proper error handling. Organizations using affected versions of redis-parser should prioritize remediation to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the V8 call stack, causing an uncaught RangeError that terminates the Node.js process without triggering error handling callbacks.