HighGHSA-35q2-47q7-3pc3CVE-2021-29469
Node-Redis potential exponential regex in monitor mode
Published 27 Apr 2021 · Updated 8 Jul 2026
Affected package
redisnpm
- Affected
- >=2.6.0 <3.1.1
- Fixed in
- 3.1.1
Update to the fixed version for your release line, for example:
npm install redis@3.1.1Details
Impact
When a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service.
Patches
The problem was fixed in commit `2d11b6d` and was released in version 3.1.1.
References
#1569 (GHSL-2021-026)
Is GHSA-35q2-47q7-3pc3 in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected redis, and gives you the command that fixes it.
References
- Linkgithub.com/NodeRedis/node-redis/security/advisories/GHSA-35q2-47q7-3pc3
- Advisorynvd.nist.gov/vuln/detail/CVE-2021-29469
- Linkgithub.com/NodeRedis/node-redis/commit/2d11b6dc9b9774464a91fb4b448bad8bf699629e
- Linkgithub.com/NodeRedis/node-redis/releases/tag/v3.1.1
- Linksecurity.netapp.com/advisory/ntap-20210611-0010
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.