{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/parse-server--8.6.115-9.0.0-before-9.10.7-alpha.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-123487"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Parse Server (\u003c 8.6.115, 9.0.0 before 9.10.7-alpha.1)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Parse Platform"],"content_html":"\u003cp\u003eParse Server versions before 8.6.115 and 9.x before 9.10.7-alpha.1 are vulnerable to a regular expression denial of service (ReDoS). The vulnerability stems from a regular expression used for email address validation that exhibits quadratic runtime complexity relative to input length. Because the application does not enforce a length limit on this input, an attacker can submit an excessively long, specially crafted email address to block the Node.js event loop, effectively denying service to all users.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an unauthenticated or authenticated attacker to cause a denial of service by hanging the Node.js process, which prevents the server from processing further requests. This can be achieved during the account sign-up process or by updating a user profile.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade Parse Server to version 8.6.115 or higher, or 9.10.7-alpha.1 or higher.\u003c/li\u003e\n\u003cli\u003eImplement request body size limits and input length validation at the load balancer or web application firewall (WAF) level to mitigate the submission of malformed, oversized email addresses.\u003c/li\u003e\n\u003cli\u003eMonitor server performance and process health for spikes in CPU usage associated with POST requests to user account endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-06T17:23:44Z","date_published":"2026-11-06T17:23:44Z","id":"https://feed.craftedsignal.io/briefs/2026-11-parse-server-redos/","summary":"Parse Server versions before 8.6.115 and 9.x before 9.10.7-alpha.1 contain a regular expression denial of service (ReDoS) vulnerability that allows unauthenticated or authenticated attackers to exhaust the Node.js event loop via crafted email addresses.","title":"Parse Server: Regular expression denial of service (CVE-2026-123487)","url":"https://feed.craftedsignal.io/briefs/2026-11-parse-server-redos/"}],"language":"en","title":"CraftedSignal Threat Feed - Parse Server (\u003c 8.6.115, 9.0.0 Before 9.10.7-Alpha.1)","version":"https://jsonfeed.org/version/1.1"}