CVE-2026-97057

HighCVSS 7.5/10Last modified Sep 24, 2026

Description

redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by supplying an excessively large declared length. A malicious or compromised Redis endpoint can deliver a crafted RESP header with a length above 2^32-1 to crash the Node.js client process.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1284

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2026
Last modified: Sep 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-970598.2DCMTK through 3.7.0 contains a heap over-read vulnerability in ConcatenationLoader that copies pixel data frames without validating the Pixe CVE-2026-970607.2X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete user CVE-2026-970614.3Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enume CVE-2026-970625.4Aureus ERP through 1.6.0, fixed in commit 53ad76d, stores uploaded SVG files on its public disk and serves them from the application origin,CVE-2026-970639.1X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys CVE-2026-970649.1X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauth CVE-2026-970657.1Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.CVE-2026-970665.3Unauthenticated Insecure Direct Object References (IDOR) in GiveWP <= 4.16.9 versions.CVE-2026-970676.5Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.CVE-2026-970706.9Authorization Bypass Through User-Controlled Key vulnerability in CozyThemes Cozy Blocks cozy-addons allows Exploiting Incorrectly Configure CVE-2026-970715.3Incorrect Calculation vulnerability in VillaTheme CURCY woo-multi-currency allows Integer Attacks.This issue affects CURCY: from n/a through CVE-2026-970744.3Subscriber Insecure Direct Object References (IDOR) in Newsletters, Email Marketing, SMS and Popups by Omnisend <= 1.9.0 versions.