CVE-2026-97057 Details

A denial-of-service vulnerability has been identified in redis-parser versions through 3.0.0. The issue arises from improper validation of the multi-bulk length in the Redis Serialization Protocol (RESP) parsing. This flaw allows attackers to send a crafted RESP header with an excessively large length, exceeding the maximum allowable array size. When the parser attempts to allocate an array with this invalid length, it triggers an uncaught RangeError, causing the Node.js client process to crash. The vulnerability can be exploited by delivering a maliciously crafted RESP header from a Redis endpoint, leading to an unhandled exception that terminates the client process.

Users can update to redis-parser version 4.0.0 or later, where this vulnerability has been addressed. If an immediate update is not possible, the vulnerability can be mitigated by manually handling errors from the parser to prevent uncaught exceptions from terminating the Node.js process.