Executive brief
FalkorDB, a Redis module for graph databases, has multiple security defects in its user-defined function (UDF) feature. An authenticated user can register JavaScript code that hangs worker threads indefinitely with no way to stop it, and UDF registrations bypass write-command protections, potentially causing replica divergence. Additionally, corrupted RDB files can cause silent library loss or buffer underflows during recovery.
Technical details
The graph.UDF command is not registered as a write operation despite mutating persistent state and being written to RDB, bypassing replica write restrictions and deny-oom checks. The RDB decoder uses unchecked ASSERT() statements that compile out in release builds, causing malformed UDF data to be silently skipped; additionally, zero-length string buffers trigger size_t underflow. An authenticated attacker can register a UDF containing an infinite loop to permanently hang a worker thread, as the QuickJS runtime lacks an interrupt handler and timeout mechanism comparable to Redis's SCRIPT KILL.
Affected products
- FalkorDB FalkorDB 4.20.1 to 4.20.4
Timeline
- 2026-09-21: disclosed