CVE-2021-29469

Katalog CVE

CVSS 7.5 · High EPSS 1,6%

Kerentanan Uncontrolled Resource Consumption pada redis.js redis. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.

Rincian

Terbit di NVD

23 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-400: Uncontrolled Resource Consumption

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 75,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e patch · advisory pihak ketiga
• https://github.com/NodeRedis/node-redis/security/advisories/GHSA-35q2-47q7-3pc3 patch · advisory pihak ketiga
• https://github.com/NodeRedis/node-redis/releases/tag/v3.1.1 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20210611-0010/ advisory pihak ketiga