Homepage

org.webjars.npm:ioredis@5.2.4

  • latest version

    5.2.4

  • first published

    3 years ago

  • latest version published

    3 years ago

  • licenses detected

  • package registry

    View on Maven Central Repository
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the org.webjars.npm:ioredis package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Uncontrolled Recursion

    org.webjars.npm:ioredis is a Redis client for Node.js.

    Affected versions of this package are vulnerable to Uncontrolled Recursion in the RESP protocol parser in lib/parser.js. An attacker can crash the Node.js client process by sending crafted RESP byte streams with repeated nested array headers. The parser recurses while handling nested arrays, exhausting the V8 call stack and triggering an uncaught RangeError. In affected deployments that consume data from a malicious or compromised Redis endpoint, this terminates the process and disrupts Redis client operations.

    How to fix Uncontrolled Recursion?

    Upgrade org.webjars.npm:ioredis to version 6.0.0-beta.1 or higher.

    [,6.0.0-beta.1)
    Go back to all versions of this package