CVE catalog

CVE-2021-29469

node-redis: CVE-2021-29469

Severity: Medium
Published: Apr 23, 2021, 6:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.63% · Oct 25, 2026

Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	node-redis	sid	`4.6.14+~1.1.2-5`	fixed
Debian	node-redis	forky	`4.6.14+~1.1.2-5`	fixed
Debian	node-redis	trixie	`4.5.1+~1.1.2-2`	fixed
Debian	node-redis	bookworm	`4.5.1+~1.1.2-1+deb12u1`	fixed
Ubuntu	node-redis	16.04	`0.12.1-2`	vulnerable
Ubuntu	node-redis	18.04	`0.12.1-2`	vulnerable
Ubuntu	node-redis	20.04	`2.8.0-1`	vulnerable
Ubuntu	node-redis	20.04	`3.0.2-1`	vulnerable
Ubuntu	node-redis	22.04	`3.0.2+~cs5.18.1-3`	vulnerable
Ubuntu	node-redis	22.04	`3.1.2+~cs6.15.1-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	node-redis	source	sid	`3.0.2+~cs5.18.1-3`	not yet assigned	Not reported	Not reported
Debian	node-redis	source	forky	`3.0.2+~cs5.18.1-3`	not yet assigned	Not reported	Not reported
Debian	node-redis	source	trixie	`3.0.2+~cs5.18.1-3`	not yet assigned	Not reported	Not reported
Debian	node-redis	source	bookworm	`3.0.2+~cs5.18.1-3`	not yet assigned	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[node-redis]Fixed
Details (2)
- 4.5.1+~1.1.2-1+deb12u1 · all · bookworm
  Fixed · Fixed: 3.0.2+~cs5.18.1-3
  dsa · node-redis · debian · bookworm; dsa · node-redis · debian · 12
- 4.5.1+~1.1.2-1+deb12u1 · all · bookworm
  Fixed · Fixed: 3.0.2+~cs5.18.1-3
  dsa · node-redis · debian · bookworm; dsa · node-redis · debian · 12

[Debian 13 (Trixie)]

[node-redis]Fixed
Details (2)
- 4.5.1+~1.1.2-2 · all · trixie
  Fixed · Fixed: 3.0.2+~cs5.18.1-3
  dsa · node-redis · debian · 13
- 4.5.1+~1.1.2-2 · all · trixie
  Fixed · Fixed: 3.0.2+~cs5.18.1-3
  dsa · node-redis · debian · 13

Observed: Oct 23, 2026, 5:56:12 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]