The redis-parser component of NodeRedis through version 3.0.0 does not properly validate the multi-bulk length field in the RESP protocol. An attacker controlling a Redis endpoint can send a crafted RESP header with a multi-bulk length value larger than 2^32-1, causing an uncaught RangeError in the Node.js client process and resulting in a crash. This denial-of-service condition arises from the failure to handle excessively large declared lengths during protocol parsing.

Successful exploitation causes the Node.js client process using redis-parser to crash due to an uncaught RangeError. This results in denial of service for applications relying on the affected redis-parser versions. There is no indication of privilege escalation, data leakage, or code execution from the provided data.

No explicit patch or remediation information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid connecting to untrusted or potentially compromised Redis endpoints that could send malicious RESP headers.