CVE-2026-97057

Name of the Vulnerable Software and Affected Versions redis-parser versions prior to 3.0.1

Description An issue exists in the RESP (Redis Serialization Protocol) parsing where the multi-bulk length value is not properly validated. A malicious or compromised Redis endpoint can send a crafted RESP header with a length exceeding 2^32-1, triggering an uncaught RangeError that crashes the Node.js client process.

Recommendations Update redis-parser to a version later than 3.0.0.