---
scope: org
organization: redis
release_count: 9
last_release: 2026-10-26
generated: 2026-05-04
updated: 2026-10-27
canonical: https://releases.sh/redis/overview.md
---

Seven patch releases fixed a heap buffer overflow in the cluster bus, triggerable by a `PUBLISH` or `SPUBLISH` message larger than 4GB.

**A cluster-bus overflow is patched across every supported line.**

- `8.10.3`, `8.8.4`, `8.6.8`, `8.4.8`, `8.2.11`, `7.4.12`, and `7.2.17` carry the same fix and are all marked security-urgent.
- Only cluster mode is exposed — the oversized message has to propagate between nodes to trigger the overflow.

**node-redis 6.4.0 beta fails traffic over to a healthy database.**

- Four new constructors — `createMultiDbClient`, `createMultiDbClientPool`, `createMultiDbCluster`, and `createMultiDbSentinel` — connect to several Redis endpoints and move traffic off a failing one, using health checks, a circuit breaker, and configurable failover. The API is experimental and may change before stable.
- Client-side caching gained OPTIN and OPTOUT tracking modes with a per-call `cache` option.
- New commands: the BLESS family, Cuckoo `CF.MEXISTS`, a Count-Min Sketch cell size, HNSW vector compression, and more `FT.SEARCH` options.

**go-redis 9.23.0 raises the Go floor and gives pipelines their own pool.**

- The module's `go` directive moved from `1.24` to `1.26`; builds on Go 1.24 or 1.25 must upgrade their toolchain.
- Every `Client`, failover and cluster node clients included, now creates a dedicated pool for `Pipeline`, `TxPipeline`, and autopipeline work, so pipeline traffic stops competing with regular commands for main-pool connections. The pool dials only when needed, holds zero connections when idle, and falls back to the main pool when full.