CVE-2026-97057 HIGH

CVE-2026-97057: redis-parser through 3.0.0 Denial of Service via Invalid Array Length

Vendor Noderedis

Product redis-parser

Weakness CWE-1284

Published September 24, 2026

Last update September 24, 2026

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process.

Key dates

02Disclosure timeline

September 24, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-97057 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1284.html AskarLabs — CWE-1284 write-up Improper Validation of Specified Quantity in Input

Related vulnerabilities

04Related CVE

CVE-2026-49110 WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.4 - Price Manipulation vulnerability CVE-2026-66679 WordPress Appointment Hour Booking plugin <= 1.5.91 - Broken Access Control vulnerability CVE-2025-49292 WordPress Profile Builder plugin <= 3.13.8 - Content Spoofing Vulnerability CVE-2024-24715 WordPress WordPress BookIt Plugin plugin <= 2.4.0 - Price Bypass Vulnerability vulnerability CVE-2024-30527 WordPress WP Express Checkout plugin <= 2.3.7 - Price Manipulation vulnerability