CVE-2021-29469: Node-Redis potential exponential regex in monitor mode
Summary
CVE-2021-29469: Node-Redis potential exponential regex in monitor mode. Affects redis versions >= 2.6.0, < 3.1.1. Fixed in 3.1.1. How to fix ↓
Also tracked for
- node-redis · Debian:11
The same CVE-2021-29469 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'redis' package is an npm package that provides a client for Redis, an open-source in-memory data structure store. It allows users to interact with Redis servers and perform various operations such as storing, retrieving, and manipulating data. The package is widely used in Node.js applications for caching, session management, and real-time data processing. However, a vulnerability has been discovered in the package that affects its monitoring mode functionality.
Vulnerability Detail
The vulnerability in the 'redis' package arises when a client is in monitoring mode. The regular expression used to detect monitor messages can cause exponential backtracking on certain strings. This issue can be exploited to launch a denial of service attack, potentially leading to the unavailability of the Redis server. The vulnerability has a CVSS score of 7.5, indicating a high severity level. It was identified and reported as GHSA-35q2-47q7-3pc3, and it is also tracked under the CVE identifier CVE-2021-29469. The vulnerability affects versions of the 'redis' package starting from 2.6.0 up to version 3.1.0. The issue was fixed in commit 2d11b6d and released in version 3.1.1.
How To Fix
Latest published version: 6.3.0 as of 23 Oct 2026
npm install redis@6.3.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.1
This is the first release that contains the fix.
npm install redis@3.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the fixed version is not immediately possible, a temporary workaround can be implemented by disabling the monitoring mode in the application. This can be done by removing or commenting out the code that enables the monitoring mode. However, it is important to note that this workaround will disable the monitoring functionality, which may impact the application's ability to track Redis server activities.
Conclusion
The 'redis' package is vulnerable to a denial of service attack when the client is in monitoring mode. Upgrading to version 3.1.1 or later is the recommended solution to fix the vulnerability. If immediate upgrade is not possible, disabling the monitoring mode can serve as a temporary workaround. It is important to stay vigilant and apply security patches promptly to protect against potential exploits. For additional support and guidance, feel free to contact DevNack.com.
See every vulnerability recorded for redis →
FAQ
The vulnerability can lead to a denial of service attack, potentially causing the Redis server to become unavailable.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your package-lock.json file to the playground, and it will analyze the dependencies and alert you if any vulnerabilities are found.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
At the time of this report, there are no known public exploits for this vulnerability. However, it is always recommended to apply security patches promptly to mitigate the risk.
For further support on vulnerability remediation, you can reach out to info@devnack.com. They can provide assistance and guidance in addressing the vulnerability in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for redis.
