Parse Server: Regular expression denial of service (CVE-2026-123487)

Parse Server versions before 8.6.115 and 9.x before 9.10.7-alpha.1 are vulnerable to a regular expression denial of service (ReDoS). The vulnerability stems from a regular expression used for email address validation that exhibits quadratic runtime complexity relative to input length. Because the application does not enforce a length limit on this input, an attacker can submit an excessively long, specially crafted email address to block the Node.js event loop, effectively denying service to all users.

Impact

The vulnerability allows an unauthenticated or authenticated attacker to cause a denial of service by hanging the Node.js process, which prevents the server from processing further requests. This can be achieved during the account sign-up process or by updating a user profile.

Recommendation

• Upgrade Parse Server to version 8.6.115 or higher, or 9.10.7-alpha.1 or higher.
• Implement request body size limits and input length validation at the load balancer or web application firewall (WAF) level to mitigate the submission of malformed, oversized email addresses.
• Monitor server performance and process health for spikes in CPU usage associated with POST requests to user account endpoints.