CVE-2026-123487: Parse Server email validation regex denial of service

CVE-2026-123487 · Severity: high · CVSS 7.5 · Published 2026-11-06

Parse Server is a backend framework that provides user authentication and data management for mobile and web applications. An attacker can craft a malicious email address during sign-up or account update that causes the server's email validation logic to consume excessive CPU, blocking all legitimate user requests and causing a complete service outage. This requires knowledge of the application ID but no authentication, and any logged-in user can also trigger it.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-123487 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123487 being exploited in the wild.
How severe is CVE-2026-123487?
High severity, with a CVSS score of 7.5, published 6 November 2026.
Which products and versions are affected?
Parse Community Parse Server 8.x before 8.6.115 and 9.0.0 before 9.10.7-alpha.1.
Is there a fix for CVE-2026-123487?
Yes: fixed in Parse Server 8.6.115, 9.10.7-alpha.1. Until then: Add a Cloud Code beforeSave trigger for the _User class that rejects email addresses longer than 254 characters. Alternatively, restrict request body size at a reverse proxy or restrict the create class-level permission on the _User class to prevent unauthenticated sign-ups.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22","note":"GitHub Security Advisory GHSA-9492-427f-466x published"},{"kind":"advisory","at":"2026-11-06","note":"CVE-2026-123487 and NVD entry published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123487 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-123487?
Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Parse Server 8.6.115, 9.10.7-alpha.1

Add a Cloud Code beforeSave trigger for the _User class that rejects email addresses longer than 254 characters. Alternatively, restrict request body size at a reverse proxy or restrict the create class-level permission on the _User class to prevent unauthenticated sign-ups.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-22","note":"GitHub Security Advisory GHSA-9492-427f-466x published"},{"kind":"advisory","at":"2026-11-06","note":"CVE-2026-123487 and NVD entry published"}]

Technical details

Parse Server uses a regular expression to validate email format that exhibits quadratic backtracking complexity (ReDoS - Regular Expression Denial of Service) with no length limit on input. An unauthenticated attacker can exploit this via the sign-up endpoint by providing a crafted long email address, or an authenticated user can trigger it during email update, causing the Node.js event loop to block and denying service to all clients on that server process. The vulnerability was fixed by replacing the inefficient regex with a linear-time equivalent validation.

Affected products

  • Parse Community Parse Server 8.x before 8.6.115 and 9.0.0 before 9.10.7-alpha.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.