GCVE - cpe:2.3:a:noderedis:redis-parser:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:noderedis:redis-parser:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Noderedis (`17e078fd-2ad2-52fc-8994-9eeed1292bb8`)
Product	Redis Parser (`743fa2ec-61b2-509f-a2b9-e2f2ea9737ba`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-93435`	vulnerable	2026-10-13 12:28:56.120299	redis-parser through 3.0.0 Denial of Service via Unbounded Recursion HIGH (7.5) redis-parser through 3.0.0 contains a denial of service vulnerability in the RESP protocol parser that allows malicious Redis endpoints to crash the client process through unbounded recursion on nested arrays. Attackers can send crafted RESP byte streams with repeated array headers that exhaust the V8 call stack, causing an uncaught RangeError that terminates the Node.js process without triggering error handling callbacks. Published: 2026-09-17T22:15:31.338Z Updated: 2026-09-28T14:35:35.359Z Open on db.gcve.eu Reference links https://github.com/redis/ioredis/issues/2108 https://github.com/NodeRedis/node-redis-parser/issues/66 https://github.com/NodeRedis/node-redis-parser/blob/701655430f5f7d9ca00892a02f7eefcbc1193a98/lib/parser.js#L204-L213 https://github.com/NodeRedis/node-redis-parser/blob/701655430f5f7d9ca00892a02f7eefcbc1193a98/lib/parser.js#L291-L306 https://github.com/NodeRedis/node-redis-parser	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.