redis-parser through 3.0.0 fails to validate the multi-bulk length value in the RESP protocol parsing, allowing attackers to trigger an uncaught RangeError by specifying an excessively large declared length. The resulting crash terminates the Node.js client process, which can be used to perform a denial of service against any application that depends on the library. The weakness is identified as CWE-1284 and CWE-130.

All Node.js applications using node-redis-parser version 3.0.0 or earlier, including projects that import the library via NodeRedis, are at risk. The vulnerability is present in all releases up to and including 3.0.0, regardless of other Node.js or Redis server versions.

The CVSS score of 8.7 places the issue in the high‑severity category. The EPSS score of < 1% indicates a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that attackers need control over the Redis endpoint that sends the malformed length value; they could compromise a Redis server or supply malicious input to a trusted Redis instance. Once the length header is parsed, an uncaught RangeError immediately terminates the client process, providing an exploitable DoS vector.