Loop with Unreachable Exit Condition ('Infinite Loop') Affecting redisinsight package, versions <3.2.0-r2


Severity

Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.03% (9th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-REDISINSIGHT-15747290
  • published22 Mar 2026
  • disclosed10 Mar 2026

Introduced: 10 Mar 2026

CVE-2026-31808  (opens in a new tab)
CWE-835  (opens in a new tab)

How to fix?

Upgrade Chainguard redisinsight to version 3.2.0-r2 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream redisinsight package and not the redisinsight package as distributed by Chainguard. See How to fix? for Chainguard relevant fixed versions and status.

file-type detects the file type of a file, stream, or data. Prior to 21.3.1, a denial of service vulnerability exists in the ASF (WMV/WMA) file type detection parser. When parsing a crafted input where an ASF sub-header has a size field of zero, the parser enters an infinite loop. The payload value becomes negative (-24), causing tokenizer.ignore(payload) to move the read position backwards, so the same sub-header is read repeatedly forever. Any application that uses file-type to detect the type of untrusted/attacker-controlled input is affected. An attacker can stall the Node.js event loop with a 55-byte payload. Fixed in version 21.3.1.

CVSS Base Scores

version 3.1