Packages / redis / Security

HighVulnerabilityGHSA-35q2-47q7-3pc3CVE-2021-29469Published 27 Apr 2021

Node-Redis potential exponential regex in monitor mode

Affected · redis

  • >= 2.6.0, < 3.1.1

Fixed in

3.1.1

npm install redis@3.1.1

  1. Not affected

    0.0.1 – 2.5.3

    87 releases

  2. Affected

    2.6.0 – 3.1.0

    13 releases

  3. Fixed

    3.1.1 – 6.3.0

    59 releases, latest

159 stable releases of redis, oldest to newest.

What happens

Impact

When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service.

Patches

The problem was fixed in commit 2d11b6d and was released in version 3.1.1.

References

#1569 (GHSL-2021-026)