Denial of Service Vulnerability in Node-Redis Package
Summary
CVE-2021-29469: Node-redis is a Node.js Redis client. Affects node-redis versions < 3.0.2+~cs5.18.1-3. Fixed in 3.0.2+~cs5.18.1-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node-Redis is a popular Node.js client for interacting with Redis, a powerful in-memory data structure store. It is widely used for caching, session management, and real-time analytics due to its speed and efficiency. The package allows developers to easily connect and communicate with Redis databases, providing features such as pub/sub messaging and monitoring capabilities. However, prior to version 3.1.1, Node-Redis had a vulnerability that could lead to denial of service when in monitoring mode.
Vulnerability Detail
The vulnerability arises from a regex pattern used to detect monitor messages in Node-Redis. When a client is in monitoring mode, certain strings could trigger exponential backtracking in the regex engine, leading to significant performance degradation or a complete denial of service. This issue is particularly concerning as it can be exploited by sending specially crafted monitor messages, potentially causing the application to become unresponsive.
How To Fix
Minimum fixed version
3.0.2+~cs5.18.1-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-redisTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider disabling monitoring mode in your application until the package can be updated. This can be done by avoiding the use of the monitor command in your Redis client code.
Conclusion
The Node-Redis package had a significant vulnerability that could lead to denial of service when in monitoring mode. It is crucial for developers using this package to update to version 3.1.1 or later to mitigate the risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for node-redis →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to denial of service, making your application unresponsive and affecting user experience.
Yes, version 3.1.1 and later of Node-Redis has patched this vulnerability and is considered safe.
If you cannot update the package, consider disabling monitoring mode in your application as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-redis.
