Executive brief
Parse Server is a backend-as-a-service platform that handles API requests for mobile and web applications. An unauthenticated attacker can send specially crafted HTTP requests with malicious client version headers that cause the server to consume minutes of CPU time due to inefficient regex parsing, allowing a small number of concurrent requests to disable the service for legitimate users.
Technical details
The vulnerability exists in Parse Server's request-header parser, which uses a regular expression with polynomial backtracking characteristics to parse the X-Parse-Client-Version HTTP header and _ClientVersion JSON body field. An unauthenticated attacker who knows the target's publicly-disclosed Parse Application ID can craft adversarial input (via either header or JSON body) that triggers catastrophic backtracking in this regex. Critically, the vulnerable parsing occurs before session authentication and rate limiting on every /parse/* request, meaning the CPU-intensive operation runs synchronously on a Node.js worker thread regardless of access controls. A single large request can pin a worker for minutes; multiple concurrent requests can saturate all available workers and cause denial of service. The fix removes the client SDK version capture and parsing logic entirely, silently ignoring both the X-Parse-Client-Version header and _ClientVersion body field on all requests.
Affected products
- parse-community parse-server >=9.0.0, <9.9.1-alpha.1 and <8.6.77
Timeline
- 2026-05-23: disclosed
- 2026-05-17: patched: Patches merged to release branches; versions 9.9.1-alpha.1 and 8.6.77 contain fixes