Security vulnerabilities and automated fixes for redis issues
2 posts found
The WebSocketCrossServerAdapter class in a popular Node.js WebSocket library lacked any rate limiting on inbound messages, allowing attackers to flood Redis nodes and WebSocket servers with high-volume traffic. The fix introduces a configurable `rateLimit` option that caps messages per connection per second, preventing resource exhaustion while preserving legitimate functionality.
A high-severity rate limiting vulnerability was discovered in the Everclaw Key API's server.js file, where the checkIpRateLimit() function used in-memory storage that reset on server restarts and didn't synchronize across multiple instances. The fix migrates to Redis-backed rate limiting, ensuring persistent, distributed protection against API key request abuse.