Description

Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular expression whose run time grows quadratically with input length and that is applied without a length limit. An unauthenticated attacker who knows the application ID can send a sign-up request, or a logged-in user can update their own email, with a long crafted email address to block the Node.js event loop and deny service to all clients.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-11-06T15:17:17.947Z",
  "pubdate": "2026-11-06T15:17:17.947Z",
  "executiveSummary": "A ReDoS (Regular Expression Denial of Service) vulnerability exists in Parse Server due to inefficient regex pattern matching used for email address validation.\nThe vulnerability affects Parse Server versions prior to 8.6.115 and 9.0.0 versions prior to 9.10.7-alpha.1.\nBy submitting a maliciously crafted, excessively long email address string, an attacker can trigger catastrophic backtracking in the Node.js regex engine.\nBecause Node.js is single-threaded, this resource-intensive operation blocks the event loop, effectively denying service to all legitimate clients.\nExploitation does not necessarily require high-level privileges; unauthenticated attackers possessing a valid application ID can initiate the attack via sign-up requests, while authenticated users can trigger it via profile update operations.\nThe primary risk is a complete loss of availability for the affected Parse Server instance.",
  "technicalDetails": "The root cause of this vulnerability is the use of a non-optimized regular expression for validating email address formats within the Parse Server codebase. Regular expressions that exhibit quadratic time complexity relative to the input length, when combined with the absence of input length constraints, facilitate ReDoS attacks.\nIn the Node.js environment, the regex engine processes patterns using a backtracking algorithm. When presented with crafted, deeply ambiguous, or 'evil' regex patterns combined with specifically designed input strings—often characterized by repeated, overlapping, or nested groups—the engine attempts to explore an exponential number of possible matching paths before concluding the match or failure.\nIn this specific context, the email validation logic lacks a maximum length check, allowing an attacker to submit an arbitrarily large input. When this input is processed, the regex engine enters a state of catastrophic backtracking. Since the Node.js event loop is single-threaded, this heavy computational burden occupies the CPU, preventing the engine from processing other concurrent requests or internal tasks.\nThe attack flow follows a predictable pattern: 1) The attacker identifies a target Parse Server instance and obtains the application ID. 2) The attacker crafts a payload—a specially structured, extremely long string designed to maximize backtracking complexity for the vulnerable regex. 3) The attacker submits this payload via an exposed API endpoint, such as a user registration/sign-up endpoint or an account update endpoint for existing users. 4) Upon processing the request, Parse Server invokes the vulnerable regex validation function. 5) The regex engine becomes trapped in the backtracking loop, consuming 100% of the CPU core allocated to the Node.js process. 6) The event loop becomes blocked, resulting in a denial of service for all users of the application.\nThis vulnerability is particularly severe because the attack requires minimal technical sophistication, utilizes legitimate API endpoints, and effectively paralyzes the entire service for all users, regardless of their authentication status."
}