Find, fix and prevent vulnerabilities in your code.

Overview

ioredis is a Redis client for Node.js.

Affected versions of this package are vulnerable to Uncontrolled Recursion in the RESP protocol parser in lib/parser.js. An attacker can crash the Node.js client process by sending crafted RESP byte streams with repeated nested array headers. The parser recurses while handling nested arrays, exhausting the V8 call stack and triggering an uncaught RangeError. In affected deployments that consume data from a malicious or compromised Redis endpoint, this terminates the process and disrupts Redis client operations.

Remediation

Upgrade ioredis to version 6.0.0-beta.1 or higher.

References

• GitHub Issue
• GitHub PR
• Vulnerable Code
• Vulnerable Code
• Vulnerable Code decoder.ts:646-713

Overview

@opentelemetry/core is an OpenTelemetry Core provides constants and utilities shared by all OpenTelemetry SDK packages.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the extract function. An attacker can cause excessive memory allocation by sending oversized baggage HTTP headers or equivalent data via non-HTTP transports.

Note: This is only exploitable if the deployment does not enforce transport-layer header size limits, such as when using custom transports or when default HTTP header size limits are increased.

Workaround

This vulnerability can be mitigated by configuring strict header size limits at the server or gateway level, or by validating input size before passing it to the propagator in non-HTTP transports.

Remediation

Upgrade @opentelemetry/core to version 2.8.0 or higher.

References

• GitHub Advisory
• GitHub Commit