Parse Server 9.0.0 before 9.10.7-alpha.1 ReDoS via Email Validation Regex
Parse Server 9.0.0 before 9.10.7-alpha.1 and versions before 8.6.115 are affected in deployments that allow user sign-up, which is the default. Fixed in 9.10.7-alpha.1 and 8.6.115.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 9.10.7-alpha.1, 8.6.115
- Who is exposed
- Default setups
Do first: Check every install: default setups are affected.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 34/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Default setups
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
Parse Server, a Node.js backend framework, is affected by a regular-expression flaw in its email validation that lets an unauthenticated attacker remotely, without logging in, send a sign-up request or email update containing a long crafted address. The resulting slowdown blocks the Node.js event loop and denies service to all clients.
Read the original description
Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular expression whose run time grows quadratically with input length and that is applied without a length limit. An unauthenticated attacker who knows the application ID can send a sign-up request, or a logged-in user can update their own email, with a long crafted email address to block the Node.js event loop and deny service to all clients.
cve.now Index
- Exploitation0/40No signal
- Exposure25/25Default setups, CISA rates it automatable
- Reach?/20Unknown. No tracked technology or package matched
- Severity8.7/10CVSS 8.7
- No patch0/5No signal
What would change the score
- Would score about 74 if added to CISA KEV
- Would score about 69 if CISA's SSVC rates exploitation active
What to do
Check every install: default setups are affected.
Upgrade to a fixed version: 9.10.7-alpha.1, 8.6.115.
Workaround: Add a Cloud Code beforeSave trigger for the _User class that rejects email addresses longer than 254 characters
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- parse-community parse-server
From 9.0.0 · fixed in 9.10.7-alpha.1
- parse-community parse-server
fixed in 8.6.115
Evidence 2
- Advisory
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-123487
Is CVE-2026-123487 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A crafted, long email address sent during user validation blocks the Node.js event loop, which denies service to all clients of the server process.Source: vulncheck.com, github.com
Which versions are affected by CVE-2026-123487?
parse-server: from 9.0.0 before 9.10.7-alpha.1. parse-server: before 8.6.115.Source: cve.now feed data
Am I affected, and how do I check?
Parse Server versions 9.0.0 before 9.10.7-alpha.1 and versions before 8.6.115 are affected. Deployments that allow user sign-up, which is the default, are the affected setup, so check the installed Parse Server version and whether sign-up is enabled.Source: vulncheck.com, github.com
How do I fix CVE-2026-123487?
Upgrade to 9.10.7-alpha.1 or later in the 9.x line, or to 8.6.115 or later in the 8.x line. Until then, a workaround is a Cloud Code beforeSave trigger for the _User class that rejects email addresses longer than 254 characters.Source: vulncheck.com, github.com