Redis 8.8: Array Type, Atomic Rate Limiter, 83% Faster

Redis 8.8 shipped on June 2, 2026 with two additions backend developers have been asking for longer than they probably care to admit: a native Array data type and INCREX, an atomic rate-limiter command that finally retires the INCR+EXPIRE race condition and the Lua scripts patched around it. The release also delivers throughput improvements up to 83% on streams, 68% on MGET, and 74% on sorted sets — plus five CVE fixes that make upgrading non-optional for production deployments.

INCREX: Rate Limiting Without the Lua Tax

The old approach to rate limiting in Redis was embarrassingly fragile. INCR + EXPIRE has a race condition: if the process dies between the two commands, the key never expires. The fix was a Lua script — which is atomic, but also a maintenance liability that nobody wants debugging at 2 AM. Redis 8.8 replaces this with a single native command.

The core pattern: INCREX ratelimit:{user_id} BYINT 1 UBOUND 100 EX 60 ENX. The command returns a two-element array — [new_value, actual_increment]. If actual_increment is 0, the limit was hit; reject the request. The ENX flag sets the TTL only on the first request, creating a fixed window. Omit ENX and each request resets the TTL — a sliding window. That distinction matters, and the API makes it explicit.

# Fixed window: 100 requests per 60 seconds
new_val, actual_incr = redis.execute_command(
    "INCREX", f"ratelimit:{user_id}",
    "BYINT", 1,     # increment by 1
    "UBOUND", 100,  # cap at 100
    "EX", 60,       # 60-second window
    "ENX",          # set TTL only on first request
)
if actual_incr == 0:
    raise RateLimitExceeded()

Under the hood, INCREX uses GCRA (Generic Cell Rate Algorithm), the same algorithm behind the redis-cell Lua module — which means it handles burst behavior correctly, not just simple windowed counting. Redis should have shipped this natively years ago, but it’s here now.

The Array Type: O(1) Random Access Redis Has Always Needed

Redis has had Lists, Hashes, Sets, and Sorted Sets. What it’s always lacked is a data structure for position-indexed collections with fast random access. Lists are linked-list-based — O(n) to read position 50,000. Hashes use string field names, not integer indices. Array fills that gap: integer-indexed, dynamically sized, O(1) random read and write.

According to the official Redis 8.8 benchmarks at 100K elements with 1KB values, Array reads at 675K ops/sec versus 626K for Hash and 133K for List. For ring buffer use cases — bounded logs, circular event windows, sliding-window analytics — Array ring mode delivers 1.12M inserts/sec compared to 528K for the classic RPUSH+LTRIM pattern. Server-side aggregations (SUM, MIN, MAX) run without pulling data to the client, which matters for large windows over high-frequency sensor or financial data.

Related: node-redis 6.0: RESP3 Default and What to Do Now

Throughput Improvements and Five CVEs Worth Knowing About

The performance improvements in 8.8 are not marginal. Stream throughput (XREADGROUP COUNT 100) is up to 83% faster. Sorted set operations up to 74%. Pipelined MGET with I/O threads up to 68%. HGETALL on large hashes up to 25%. Full replication sync up to 60% faster. These come from Redis’s own benchmarks — real-world gains depend on workload — but the direction across every data type is consistent.

Five CVEs are fixed in this release. CVE-2026-23479 is a use-after-free in the unblock client flow; CVE-2026-23631 is a Lua use-after-free; three others cover invalid memory access in RESTORE across core, Time Series, and Probabilistic modules. The full list is in the Redis 8.8 release notes. If you’re on any Redis 8.x version in production, these patches alone justify scheduling the upgrade.

Ecosystem Reality Check: Redis vs. Valkey in 2026

If you’re on AWS ElastiCache or Google Memorystore, you’re likely already running Valkey — the Linux Foundation fork that became the default on major cloud providers after Redis’s SSPL license change in 2024. Redis restored BSD licensing in 2025, but the cloud defaults didn’t flip back. Valkey doesn’t have the Array type or INCREX yet. The Hacker News discussion on Redis 8.8 is mostly developers explaining why they’re staying on Valkey despite the feature gap — trust recovery takes longer than a license change.

This is not a reason to migrate back from Valkey — that’s a larger decision than a feature list warrants. However, if you self-host Redis or use Redis Cloud, 8.8 is where these features live. Know which implementation you’re running before trying to use INCREX in production.

Key Takeaways

• INCREX replaces INCR+EXPIRE race conditions and Lua rate-limiting scripts. Returns [new_value, actual_increment] — check if actual_increment == 0 to detect limit hits. Use ENX for fixed windows, omit for sliding windows.
• Array is 5x faster than List for random access and 2x faster for ring buffer operations. Use it for integer-indexed storage with O(1) access or server-side aggregation needs.
• Throughput is meaningfully better across all data types — up to 83% on streams, 74% on sorted sets, 68% on pipelined MGET. The upgrade path from Redis 8.x is straightforward.
• Five CVE fixes including two use-after-free vulnerabilities make 8.8 a security-mandatory upgrade for production 8.x deployments.
• Check your implementation: AWS ElastiCache, Google Memorystore, and Akamai default to Valkey. Array and INCREX are Redis 8.8 features — not available in Valkey yet.