CVE-2026-93435

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-93435

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93435.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-93435

Published

2026-09-17T22:15:31Z

Modified

2026-09-19T03:47:27Z

Severity

8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

redis-parser through 3.0.0 Denial of Service via Unbounded Recursion

Details

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the V8 call stack, causing an uncaught RangeError that terminates the Node.js process without triggering error handling callbacks.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-674"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/93xxx/CVE-2026-93435.json"
}

References

Affected packages

Git / github.com/noderedis/node-redis-parser

Affected ranges

Type

GIT

Repo

https://github.com/noderedis/node-redis-parser

Events

Introduced

Fixed

701655430f5f7d9ca00892a02f7eefcbc1193a98

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "3.0.0"
        },
        {
            "fixed": "3.0.0"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "DESCRIPTION"
    ]
}

Affected versions

v.*

v.1.0.0

v.1.1.0

v.1.3.0

v.2.0.0

v.2.0.1

v.2.0.2

v.2.0.3

v.2.0.4

v.2.1.0

v.2.1.1

v.2.2.0

v.2.3.0

v.2.4.0

v.2.4.1

v.2.5.0

v.2.6.0

v1.*

v1.2.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-93435.json"