CVE-2026-47138: Parse Community Parse Server ReDoS in client version parsing

CVE-2026-47138 · Severity: high · CVSS 4 · Published 2026-06-12

Parse Server is a backend-as-a-service platform that handles API requests for mobile and web applications. An unauthenticated attacker can send specially crafted HTTP requests with malicious client version headers that cause the server to consume minutes of CPU time due to inefficient regex parsing, allowing a small number of concurrent requests to disable the service for legitimate users.

Technologies: parse-server (npm). Vendors: npm.

Quick answers

Is CVE-2026-47138 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-47138 being exploited in the wild.
How severe is CVE-2026-47138?
High severity, with a CVSS score of 4, published 12 June 2026.
Which products and versions are affected?
parse-server (npm) SEMVER:introduced=9.0.0,fixed=9.9.1-alpha.1.
Is there a fix for CVE-2026-47138?
Yes. parse-server (npm): upgrade to 9.9.1-alpha.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-47138 attacked?
It is attacked over the network.
Am I affected by CVE-2026-47138?
Check whether you run parse-server (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • parse-server (npm): upgrade to 9.9.1-alpha.1 or later
    npm install parse-server@9.9.1-alpha.1

Technical details

The vulnerability exists in Parse Server's request-header parser, which uses a regular expression with polynomial backtracking characteristics to parse the X-Parse-Client-Version HTTP header and _ClientVersion JSON body field. An unauthenticated attacker who knows the target's publicly-disclosed Parse Application ID can craft adversarial input (via either header or JSON body) that triggers catastrophic backtracking in this regex. Critically, the vulnerable parsing occurs before session authentication and rate limiting on every /parse/* request, meaning the CPU-intensive operation runs synchronously on a Node.js worker thread regardless of access controls. A single large request can pin a worker for minutes; multiple concurrent requests can saturate all available workers and cause denial of service. The fix removes the client SDK version capture and parsing logic entirely, silently ignoring both the X-Parse-Client-Version header and _ClientVersion body field on all requests.

Affected products

  • parse-community parse-server >=9.0.0, <9.9.1-alpha.1 and <8.6.77

Identifiers

  • CVE-2026-47138
  • GHSA-38m6-82c8-4xfm

Timeline

  • 2026-05-23: disclosed
  • 2026-05-17: patched: Patches merged to release branches; versions 9.9.1-alpha.1 and 8.6.77 contain fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.