{"id":"CVE-2026-123487","kind":"vulnerability","aliases":["CVE-2026-123487"],"related":[],"title":"Parse Server: email regex lets long input block Node.js event loop","description":"Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular expression whose run time grows quadratically with input length and that is applied without a length limit. An unauthenticated attacker who knows the application ID can send a sign-up request, or a logged-in user can update their own email, with a long crafted email address to block the Node.js event loop and deny service to all clients.","summary":"Parse Server validates user email addresses with a regular expression whose run time grows quadratically with input length and has no length limit. A long crafted email on sign-up or email update blocks the Node.js event loop, denying service to all clients.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backend-as-a-service","node.js","package","parse-server","self-hosted"],"not_affected_if":["no-public-signup","patched-version"],"how_to_check":"- Check the installed Parse Server version with `npm ls parse-server`\n- Look for `parse-server` in `package.json` and the lockfile to confirm the version range in use","fix":"- Parse Server `8.6.115` or later on the 8.x line\n- Parse Server `9.10.7-alpha.1` or later on the 9.x line","status":"open","published_at":"2026-11-06T15:17:17+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:06+00:00","updated_at":"2026-11-06T15:44:06+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T15:44:06Z","model":"claude-haiku-5-5","output":{"fix":"- Parse Server `8.6.115` or later on the 8.x line\n- Parse Server `9.10.7-alpha.1` or later on the 9.x line","reach":"internet","title":"Parse Server: email regex lets long input block Node.js event loop","impact":"medium","summary":"Parse Server validates user email addresses with a regular expression whose run time grows quadratically with input length and has no length limit. A long crafted email on sign-up or email update blocks the Node.js event loop, denying service to all clients.","audience":"businesses","category":"package","nicknames":[],"who_cares":["parse-server","node.js","self-hosted","backend-as-a-service"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Server event loop blocked, denying service to all clients","analyst_note":"","how_to_check":"- Check the installed Parse Server version with `npm ls parse-server`\n- Look for `parse-server` in `package.json` and the lockfile to confirm the version range in use","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-public-signup"],"who_is_affected":"Applications that run Parse Server and accept sign-up requests or email updates from the internet are exposed, since the flaw needs only the application ID and no account. Deployments that run a patched version, or that never expose sign-up or email change endpoints, are not reachable through this path.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00069,"input_tokens":4309,"output_tokens":518,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123487':14A,17A '-2026':13A,16A '8.6.115':78C '9.0.0':80C '9.10.7':82C 'address':36B,87C,140C 'alpha.1':83C 'appli':104C 'applic':115C 'attack':111C 'backend':19B 'backend-as-a-servic':18B 'block':8A,65B,142C 'client':74B,152C 'craft':56B,138C 'cve':12A,15A 'deni':70B,148C 'email':3A,35B,57B,63B,86C,134C,139C 'event':10A,68B,145C 'express':40B,92C 'format':88C 'grow':44B,96C 'host':30B 'id':116C 'input':7A,47B,99C 'know':113C 'length':48B,52B,100C,107C 'let':5A 'limit':53B,108C 'log':127C 'logged-in':126C 'long':6A,55B,137C 'loop':11A,69B,146C 'node.js':9A,23B,67B,144C 'packag':24B 'pars':1A,26B,31B,75C 'parse-serv':25B 'quadrat':45B,97C 'regex':4A 'regular':39B,91C 'request':123C 'run':42B,94C 'self':29B 'self-host':28B 'send':118C 'server':2A,27B,32B,76C 'servic':22B,71B,149C 'sign':60B,121C 'sign-up':59B,120C 'time':43B,95C 'unauthent':110C 'updat':64B,131C 'user':34B,85C,129C 'valid':33B,84C 'whose':41B,93C 'without':105C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Parse Server and accept sign-up requests or email updates from the internet are exposed, since the flaw needs only the application ID and no account. Deployments that run a patched version, or that never expose sign-up or email change endpoints, are not reachable through this path.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["backendasaservice","high","nodejs","package","parseserver","selfhosted"],"campaign_type":null,"search_a":"'-123487':14A,17A '-2026':13A,16A 'block':8A 'cve':12A,15A 'email':3A 'event':10A 'input':7A 'let':5A 'long':6A 'loop':11A 'node.js':9A 'pars':1A 'regex':4A 'server':2A","search_b":"'address':36B 'backend':19B 'backend-as-a-servic':18B 'block':65B 'client':74B 'craft':56B 'deni':70B 'email':35B,57B,63B 'event':68B 'express':40B 'grow':44B 'host':30B 'input':47B 'length':48B,52B 'limit':53B 'long':55B 'loop':69B 'node.js':23B,67B 'packag':24B 'pars':26B,31B 'parse-serv':25B 'quadrat':45B 'regular':39B 'run':42B 'self':29B 'self-host':28B 'server':27B,32B 'servic':22B,71B 'sign':60B 'sign-up':59B 'time':43B 'updat':64B 'user':34B 'valid':33B 'whose':41B","search_c":"'8.6.115':78C '9.0.0':80C '9.10.7':82C 'address':87C,140C 'alpha.1':83C 'appli':104C 'applic':115C 'attack':111C 'block':142C 'client':152C 'craft':138C 'deni':148C 'email':86C,134C,139C 'event':145C 'express':92C 'format':88C 'grow':96C 'id':116C 'input':99C 'know':113C 'length':100C,107C 'limit':108C 'log':127C 'logged-in':126C 'long':137C 'loop':146C 'node.js':144C 'pars':75C 'quadrat':97C 'regular':91C 'request':123C 'run':94C 'send':118C 'server':76C 'servic':149C 'sign':121C 'sign-up':120C 'time':95C 'unauthent':110C 'updat':131C 'user':85C,129C 'valid':84C 'whose':93C 'without':105C","first_public_at":"2026-10-22T18:19:12+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123487","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123487","severity":null,"published_at":"2026-11-06T15:17:17+00:00","modified_at":"2026-11-06T15:17:18+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null}],"documents":[{"id":87554,"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-9492-427f-466x","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T18:19:12+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87555,"url":"https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.7-alpha.1-redos-via-email-validation-regex","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}