Skip to content

Node-Redis potential exponential regex in monitor mode

High severity GitHub Reviewed Published Apr 23, 2021 in redis/node-redis • Updated Jan 29, 2023

Package

npm redis (npm)

Affected versions

>= 2.6.0, < 3.1.1

Patched versions

3.1.1

Description

Impact

When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service.

Patches

The problem was fixed in commit 2d11b6d and was released in version 3.1.1.

References

#1569 (GHSL-2021-026)

References

@leibale leibale published to redis/node-redis Apr 23, 2021
Reviewed Apr 23, 2021
Published by the National Vulnerability Database Apr 23, 2021
Published to the GitHub Advisory Database Apr 27, 2021
Last updated Jan 29, 2023

Severity

High
7.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CVE ID

CVE-2021-29469

GHSA ID

GHSA-35q2-47q7-3pc3

Source code

No known source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.