GitHub Advisoryadvisory · npm

GHSA-35q2-47q7-3pc3 Node-Redis potential exponential regex in monitor mode

HIGH Published 2021-04-27 Modified 2022-08-11 Official page ↗
Aliases
CVE-2021-29469
Ecosystem
npm
Packages
redis
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2021-04-23

Affected packages

• npm redis: >= 2.6.0, < 3.1.1 → fixed in 3.1.1

Description

Impact When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. Patches The problem was fixed in commit `2d11b6d` and was released in version `3.1.1`. References 1569 (GHSL-2021-026)

Related

Alias · CVE (1)

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References