CVE-2026-97057: redis-parser RESP Protocol DOS Vulnerability

CVE-2026-97057 Overview

CVE-2026-97057 is a denial-of-service vulnerability affecting the redis-parser Node.js package through version 3.0.0. The parser fails to validate the multi-bulk length value during RESP (REdis Serialization Protocol) parsing. An attacker who controls or compromises a Redis endpoint can send a crafted RESP header declaring an array length greater than 2^32-1. This triggers an uncaught RangeError inside the Node.js client, crashing the process. The weakness is categorized under [CWE-1284: Improper Validation of Specified Quantity in Input].

Critical Impact
A single malformed RESP response from a malicious or compromised Redis server can crash any Node.js client using redis-parser ≤ 3.0.0, resulting in service disruption for applications dependent on Redis connectivity.

Affected Products

redis-parser npm package, all versions through 3.0.0
Node.js applications depending on redis-parser (directly or transitively through redis client)
Services connecting to untrusted or shared Redis endpoints using the vulnerable parser

Discovery Timeline

2026-09-24 - CVE-2026-97057 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-97057

Vulnerability Analysis

The redis-parser library implements the RESP protocol used by Redis to serialize responses. When the parser encounters a multi-bulk reply (prefixed with *), it reads the declared element count from the header and uses that value to allocate and iterate over the reply array. The parser does not bound-check the declared length against JavaScript's safe integer range or V8's typed-array limits. When the declared length exceeds 2^32-1, the resulting internal operation throws a RangeError that propagates uncaught through the event loop. The Node.js runtime then terminates the process. This qualifies as a Denial of Service condition driven by Improper Validation of Specified Quantity in Input.

Root Cause

The root cause sits in the array-length handling path within lib/parser.js. Length parsing occurs around the multi-bulk branch (see lines 108–122 and 492–550 in the referenced commit). The parser trusts the integer value decoded from the RESP header and passes it to downstream allocation and loop control logic. No upper-bound sanity check rejects values that exceed Redis's documented maximum element count or Node.js engine limits. Related issues were reported upstream in GitHub Issue #47 and GitHub Issue #65.

Attack Vector

Exploitation requires the victim Node.js client to connect to a Redis endpoint controlled by the attacker, or to a legitimate endpoint that has been compromised or is reachable through a man-in-the-middle. The attacker returns a RESP frame whose header declares a multi-bulk length greater than 2^32-1, for example *4294967296\r\n. The vulnerable parser decodes this value and the subsequent operation raises an uncaught RangeError, terminating the client process. No authentication on the client side is required because the parser processes the server response before application-level checks. See the VulnCheck Denial of Service Advisory for additional detail.

// Representative malformed RESP frame (described, not executed)
// Server sends:  *4294967296\r\n
// Client parser: throws uncaught RangeError -> Node.js process exits

Detection Methods for CVE-2026-97057

Indicators of Compromise

Unexpected Node.js process crashes with stack traces referencing RangeError originating in redis-parser or node_modules/redis-parser/lib/parser.js.
Redis client reconnect storms following receipt of a response from an unfamiliar or recently reconfigured Redis endpoint.
Outbound Redis sessions (TCP/6379 or TLS/6380) to hosts not present in the service's expected inventory.

Detection Strategies

Inventory all Node.js services and resolve the dependency tree with npm ls redis-parser to identify vulnerable versions, including transitive pulls through the redis client.
Monitor application logs and container exit events for RangeError exceptions co-occurring with Redis I/O frames.
Inspect network telemetry for Redis responses carrying unusually large multi-bulk headers, specifically * prefixes with length values above typical application maxima.

Monitoring Recommendations

Alert on repeated unexpected restarts of Node.js services that maintain Redis connections.
Track egress Redis connections and flag connections to endpoints outside the approved Redis allowlist.
Correlate crash telemetry with upstream Redis endpoint identity to attribute instability to a specific server.

How to Mitigate CVE-2026-97057

Immediate Actions Required

Audit all Node.js projects for redis-parser ≤ 3.0.0 and upgrade or replace the dependency with a maintained Redis client that validates RESP length fields.
Restrict outbound Redis connectivity to a known allowlist of trusted Redis servers and block arbitrary egress to TCP/6379 and TLS/6380.
Enforce authenticated and TLS-protected Redis connections to reduce exposure to man-in-the-middle injection of malformed RESP frames.

Patch Information

No fixed version is published in the referenced advisories for redis-parser itself; the package is effectively unmaintained at the referenced commit 4c2d31c8. Consumers should migrate to the actively maintained redis or ioredis clients, which have replaced or updated their parsing paths. Reference the upstream project at GitHub Node Redis Parser and the VulnCheck Denial of Service Advisory for migration guidance.

Workarounds

Wrap Redis client initialization in a supervised process manager so that an uncaught RangeError crash results in controlled restart rather than cascading failure.
Terminate Redis traffic through a trusted proxy that validates RESP frames and rejects multi-bulk headers above a configured maximum.
Add a top-level process.on('uncaughtException', ...) handler to log and gracefully drain the affected worker, acknowledging that this mitigates symptoms but not the underlying parser flaw.

bash

# Identify vulnerable installations across a Node.js project
npm ls redis-parser

# Example: pin to a maintained client that does not depend on vulnerable redis-parser
npm uninstall redis-parser
npm install redis@latest   # or: npm install ioredis@latest