The redis-parser library used by NodeRedis versions up to 3.0.0 contains a vulnerability in its RESP protocol parser. Specifically, it does not properly limit recursion depth when parsing nested arrays, allowing an attacker controlling a Redis endpoint to send specially crafted RESP byte streams with repeated array headers. This triggers unbounded recursion, exhausting the V8 JavaScript engine call stack and causing an uncaught RangeError. The result is a denial of service condition where the Node.js client process terminates unexpectedly without invoking error handling callbacks.

Successful exploitation causes the Node.js process using redis-parser to crash, resulting in denial of service. This disrupts availability of applications relying on the affected redis-parser versions. There is no indication of privilege escalation, data corruption, or remote code execution from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider mitigating exposure by avoiding untrusted Redis endpoints or implementing process monitoring and automatic restarts to reduce downtime.