AIKIDO-2026-538318

TL;DR

The Redis Cluster client uses the slot token from a MOVED redirect error reply directly as an index into its internal slots array without validating it. A malicious or compromised cluster node, or an entity able to tamper with cluster traffic through MITM or DNS poisoning, can return a redirect whose slot token is __proto__, so that slots["__proto__"] resolves to Array.prototype and the subsequent write reaches Array.prototype, polluting every array in the process. This global prototype pollution can corrupt application data structures and disrupt process availability. The fix validates that the slot is an integer within the cluster range before using it and rejects malformed redirects with the original error.