HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-97057 — redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP...

·Source: NIST NVD

Updated:

Executive Summary

redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process.

Analysis

redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process. CVSS Score: 7.5. Published: 2026-09-24T14:18:21.683.

Indicators of Compromise (1)

CVE (1)
CVE-2026-97057
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Sep 24, 2026. Verified by: NIST.

Related Threats

CRITICALVulnerabilityNEW

US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says

Sean Cairncross said CEOs need to be cognizant of how it’s being used, however. The post US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says appeared first on CyberScoop .

CyberScoop
CRITICALVulnerabilityNEW

Cyberattacks to be insured like accidents: Ministry of Finance discusses new rules for critical infrastructure

Roman Zaharov reports: Cyberattacks may start to be insured according to the principle already in effect for hazardous facilities. The Russian Ministry of Finance is discussing the possibility of making cyber risk insurance mandatory for businesses associated with critical infrastructure. This was stated by Deputy Finance Minister Ivan Chebeskov on the sidelines of the Moscow... Source

DataBreaches.net
LOWVulnerability

Shocker: suspected ShinyHunters member charged with attempted incitement to commit two murders

Anyone following the recent arrest of Pepijn van der Stap, the previously convicted hacker known as “Umbreon,” was likely shocked today when the prosecution announced that he was being charged with two counts of attempted incitement to murder. Here’s what we know so far. A 24-year-old Dutch national who previously served time for hacking-related crimes... Source

DataBreaches.net