CVE-2021-29469: Redis.js Redis

High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days.

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.

Affected products

• Redis.js Redis: before 3.1.1 (fixed in 3.1.1)

Published 2021-04-23. Last modified 2026-06-17.