Denial of Service Vulnerability in Parse Server by Parse Community

CVE-2026-123487

What is CVE-2026-123487?

The vulnerability in Parse Server arises when the email address validation process, using a basic regular expression, is executed without limiting the input length. This design flaw allows unauthenticated users knowing the application ID to send sign-up requests with excessively long email addresses. If a registered user attempts to update their email with a crafted input, they can compromise the Node.js event loop, leading to a denial of service for all users. It is crucial for users of affected Parse Server versions to apply the recommended updates to mitigate this risk.

References