CVE-2026-123487 · Package
NO FIX YET · SEE WHAT TO DO
Parse Server validates user email addresses with a regular expression whose run time grows quadratically with input length and has no length limit. A long crafted email on sign-up or email update blocks the Node.js event loop, denying service to all clients.
first public Oct 22, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that run Parse Server and accept sign-up requests or email updates from the internet are exposed, since the flaw needs only the application ID and no account. Deployments that run a patched version, or that never expose sign-up or email change endpoints, are not reachable through this path.
Not affected if no-public-signup, patched-version
Who cares backend-as-a-service, node.js, parse-server, self-hosted
npm ls parse-serverparse-server in package.json and the lockfile to confirm the version range in use8.6.115 or later on the 8.x line9.10.7-alpha.1 or later on the 9.x lineParse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular expression whose run time grows quadratically with input length and that is applied without a length limit. An unauthenticated attacker who knows the application ID can send a sign-up request, or a logged-in user can update their own email, with a long crafted email address to block the Node.js event loop and deny service to all clients.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.