Node-Redis potential exponential regex in monitor mode

높음 7.5CVE-2021-29469 · GHSA-35q2-47q7-3pc3 · Published 23/04/2021 · updated 17/06/2026

요약

CVE-2021-29469은(는) redis (redis.js), redis에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.6%, 전체 취약점의 76.3%보다 높음.
조치: 3.1.1 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
redis redis.js	`< 3.1.1`	`3.1.1`
redis npm	`≥ 2.6.0, < 3.1.1`	`3.1.1`

Description

Impact

When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service.

Patches

The problem was fixed in commit 2d11b6d and was released in version 3.1.1.

References

#1569 (GHSL-2021-026)

NVD description

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.

References

NodeRedis/node-redis security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-29469 · ADVISORY
NodeRedis/node-redis commit 2d11b6d · WEB
NodeRedis/node-redis release v3.1.1 · WEB
security.netapp.com/advisory/ntap-20210611-0010 · WEB
security.netapp.com/advisory/ntap-20210611-0010 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free