CVE-2026-123487

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.115 Parse Server versions 9.0.0 through 9.10.7-alpha.1

Description An issue exists where user email address formats are validated using a regular expression that lacks a length limit and exhibits quadratic runtime growth relative to the input length. An unauthenticated attacker with knowledge of the application ID can submit a sign-up request, or an authenticated user can update their email, using a specially crafted long email address. This action blocks the Node.js event loop, resulting in a denial of service for all clients.

Recommendations Update Parse Server to version 8.6.115 or later. Update Parse Server to version 9.10.7-alpha.1 or later.