Product
Parse Server versions before 8.6.115 and 9.x before 9.10.7-alpha.1 contain a regular expression denial of service (ReDoS) vulnerability that allows unauthenticated or authenticated attackers to exhaust the Node.js event loop via crafted email addresses.