How BullMQ can be used with REDIS config rename-command EVAL"

[swlee-brainz]

BullMQ seems to use REDIS configuration internally with EVAL when using redis. However, in October 2025, we got a known security issue CVE-2025-49844 occurred, so I modified the setting as follows in the redis.conf file

rename-command EVAL ""

After that, bullMQ was unable to execute a job. And I meet this error.

ReplyError: ERR unknown command 'eval', with args beginning with: '--[[ Move next job to be processed to active, lock it and fetch its data. The job may be delayed, in that case we need to mo'

Is there any way to solve the problem?

[roggervalf]

hi @swlee-brainz, bullmq package has a lot of its logic under lua scripts I don't think we can prevent on using eval commands

[swlee-brainz]

It sounds so sad. I was looking forward to it just in case, but there's no way to keep BullMQ with this redis configuration. Thanks anyway. 😂

[manast]

You should upgrade your Redis instance to a version that is not affected by this issue: https://nvd.nist.gov/vuln/detail/CVE-2025-49844
The thing is that even if you are using a version affected by this issue, it can only be exploited by "an authorised user with access to your Redis instance". Of course in this regard BullMQ would be such a user but we are not exploiting this issue of course, and as we ourselves are very careful to fix all security issues that arise in our dependencies we can say that the risk for anybody taking advantage of this if you have a protected Redis instance is basically non existent.