redis

Security advisories

Grouped by the version that fixes them, so one upgrade reads as one step.

• Fixed in 3.1.1 · 1 advisory

  • HIGHNode-Redis potential exponential regex in monitor modeGHSA-35q2-47q7-3pc3

Every stable release, newest first. Notes are quoted as the maintainers published them.

1. 6.3.0

   30 September 2026

2. 6.2.1

   11 August 2026
   sentinel: cap post-connect rediscovery retries

   What's Changed

   • fix(sentinel): cap post-connect rediscovery retries

   • feat(client): add MaxCommandRedirectionsError for cluster redirections

   • fix: remove stale data listener explicitly on socket error

   • fix(client): dispose credentials subscription on every close() path

   • fix(cluster): keep batch commands routed by slot during migration

   • fix(client): decode RESP3 doubles to the value the server sent

   • fix(cluster): handle MOVED and ASK redirects for atomic MULTI

3. 6.2.0

   31 July 2026
   Cluster commands now follow the server's request/response policies. node-redis reads each command's routing policy from the server's COMMAND metadata and routes and aggregates accordingly, so the cluster client behaves much more like a single server. Multi-key commands that span hash slots — MGET, MSET, DEL, EXISTS, TOUCH, UNLINK — are transparently split per slot and their replies reassembled in caller order, so cross-slot calls that previously failed with CROSSSLOT now just work. Fan-out commands such as KEYS, DBSIZE, FLUSHALL, PING, WAIT, SCRIPT EXISTS and CONFIG SET run across every shard (or every node) and their replies are aggregated per the server's policy, SCAN walks the whole cluster behind a per-client virtual cursor, and RANDOMKEY / FT.CURSOR get correct cluster-aware routing. Replica read-scaling was also aligned with the server flags, so read-only keyless commands (DBSIZE, KEYS, SCAN, RANDOMKEY, and the RediSearch / time-series reads) can be served from replicas again.

   Highlights

   Cluster commands now follow the server's request/response policies. node-redis reads each command's routing policy from the server's COMMAND metadata and routes and aggregates accordingly, so the cluster client behaves much more like a single server. Multi-key commands that span hash slots — MGET, MSET, DEL, EXISTS, TOUCH, UNLINK — are transparently split per slot and their replies reassembled in caller order, so cross-slot calls that previously failed with CROSSSLOT now just work. Fan-out commands such as KEYS, DBSIZE, FLUSHALL, PING, WAIT, SCRIPT EXISTS and CONFIG SET run across every shard (or every node) and their replies are aggregated per the server's policy, SCAN walks the whole cluster behind a per-client virtual cursor, and RANDOMKEY / FT.CURSOR get correct cluster-aware routing. Replica read-scaling was also aligned with the server flags, so read-only keyless commands (DBSIZE, KEYS, SCAN, RANDOMKEY, and the RediSearch / time-series reads) can be served from replicas again.

   ⚠️ Behavior change for the raw sendCommand path: a table-recognized command sent raw — e.g. cluster.sendCommand(['DBSIZE']) — now follows its policy (fan-out and aggregate) instead of hitting a single node. Callers who relied on raw commands for per-node operations should target a specific node with cluster.nodeClient(node).sendCommand(...).

   This release also brings a broad wave of new command coverage across the client and modules. The time-series package gains the most: new TS.NRANGE/TS.NREVRANGE multi-key pivot commands, a TS.READ cursor reader, TS.QUERYLABELS, EXCLUDEEMPTY on MRANGE/MREVRANGE, and multi-aggregator support. RediSearch adds FT.ALIASLIST, a COLLECT reducer for FT.AGGREGATE, HNSW RERANK, timeout warnings on the FT.SEARCH family, and the full set of stemmer languages. The core client adds SUNIONCARD/SDIFFCARD, LMOVEM/BLMOVEM, ZREVRANK WITHSCORE, COMMAND DOCS, and XREAD MAXCOUNT/MAXSIZE. A large batch of correctness fixes lands for zero-valued optional arguments (LIMIT 0, DB 0, SAMPLES 0, ENTRIESREAD 0, IDLETIME/FREQ 0, ENTRIESADDED 0) that were previously dropped from the wire, alongside several cluster and sentinel connection-lifecycle fixes.

   The new HIMPORT command family (managed fieldset lifecycle) ships as experimental — see the warning below.

   New Features

   • feat(client): request/response policy routing for cluster commands (multi_shard split, fan-out aggregation, special SCAN/RANDOMKEY/FT.CURSOR) (#2996) — @nkaradzhov

   • feat: add COMMAND DOCS support (#3362) — @Hashim1999164

   • feat(client): add LMOVEM and BLMOVEM commands (#3340) — @nkaradzhov

   • feat(client): add SUNIONCARD and SDIFFCARD set-cardinality commands (#3336) — @nkaradzhov

   • feat(client): add zRevRankWithScore (#3279) — @raashish1601

   • feat(xread): add MAXCOUNT / MAXSIZE options (#3335) — @nkaradzhov

   • feat(search): expose timeout warnings on the FT.SEARCH family (#3338) — @nkaradzhov

   • feat(search): add missing RediSearch stemmer languages (#3350) — @nkaradzhov

   • feat(search): add FT.ALIASLIST (#3351) — @nkaradzhov

   • feat(search): add RERANK parameter for HNSW vector fields (#3356) — @nkaradzhov

   • feat(search): add COLLECT reducer to FT.AGGREGATE (#3310) — @nkaradzhov

   • feat(time-series): add TS.NRANGE / TS.NREVRANGE multi-key pivot commands (#3337) — @nkaradzhov

   • feat(time-series): support multiple aggregators per key in TS.NRANGE / TS.NREVRANGE (#3360) — @nkaradzhov

   • feat(time-series): add TS.QUERYLABELS (LABELS and VALUES forms) (#3354) — @nkaradzhov

   • feat(time-series): add EXCLUDEEMPTY to TS.MRANGE / TS.MREVRANGE (#3352) — @nkaradzhov

   • feat(time-series): add TS.READ cursor-read command (#3322) — @nkaradzhov

   • feat(json): add reviver support to GET, MGET, and ARRPOP (#3205) — @JeanSamGirard

   Experimental

   • feat(client): add HIMPORT command family with managed fieldset lifecycle (#3381) — @nkaradzhov. The HIMPORT family and its FieldsetRegistry/PreparedFieldsets API are experimental and unstable; the surface may change or be removed in a future release. Do not depend on it in production.

   Bug Fixes

   • fix(cluster): reject commands before the cluster topology is ready (#3321) — @GiHoon1123

   • fix(cluster): rebind abort/timeout listeners when a command moves to another queue (#3367) — @GiHoon1123

   • fix(cluster): make extractAllCommands drain the write queue (#3364) — @GiHoon1123

   • fix(sentinel): reject connect() instead of hanging when the resolved master is unreachable (#3331) — @GiHoon1123

Major versions

• 6.xsince 28 May 2026 · latest 6.3.0 · 6 releases
• 5.xsince 30 April 2025 · latest 5.12.1 · 18 releases
• 4.xsince 25 November 2021 · latest 4.7.1 · 33 releases
• 3.xsince 9 February 2020 · latest 3.1.2 · 6 releases
• 2.xsince 21 September 2015 · latest 2.8.0 · 27 releases
• 1.xsince 30 August 2015 · latest 1.0.0 · 1 release
• 0.xsince 30 December 2010 · latest 0.12.1 · 68 releases