---
id: CVE-2026-93435
title: >-
  redis-parser through 3.0.0 contains a denial of service vulnerability in the
  RESP protocol parser that allows malicious Redis endpoints to crash the client
  process through unbounded recursion on nested arrays
summary: >-
  redis-parser through 3.0.0 contains a denial of service vulnerability in the
  RESP protocol parser that allows malicious Redis endpoints to crash the client
  process through unbounded recursion on nested arrays. Attackers can send
  crafted …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-674
vendor: NodeRedis
product: redis-parser
affected:
  - redis-parser <= 3.0.0
published: '2026-09-17'
updated: '2026-09-22'
sourceUpdated: '2026-09-22T20:25:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-93435'
references:
  - url: 'https://github.com/NodeRedis/node-redis-parser'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/NodeRedis/node-redis-parser/blob/701655430f5f7d9ca00892a02f7eefcbc1193a98/lib/parser.js#L204-L213
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/NodeRedis/node-redis-parser/blob/701655430f5f7d9ca00892a02f7eefcbc1193a98/lib/parser.js#L291-L306
    label: disclosure@vulncheck.com
  - url: 'https://github.com/redis/ioredis/issues/2108'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/redis-parser-through-3.0.0-denial-of-service-via-unbounded-recursion
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.0063
epssPercentile: 0.47894
ingestedAt: '2026-09-17T22:30:21.417Z'
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-21T14:58:19.190470Z'
---

## Overview

redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the V8 call stack, causing an uncaught RangeError that terminates the Node.js process without triggering error handling callbacks.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.