# CVE-2026-123487

ReDoS via email regex in Parse Server causing Node.js event-loop DoS

- Page: https://www.vulneraibility.com/cve/CVE-2026-123487
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable yes, technical impact partial (assessed 2026-11-06)
- Weakness: CWE-1333
- Also known as: GHSA-9492-427f-466x
- Published: 2026-11-06

## Affected versions

- parse-community parse-server: affected >= 9.0.0 and < 9.10.7-alpha.1; < 8.6.115; fixed in 9.10.7-alpha.1, 8.6.115

A version outside these ranges is not a statement that it is unaffected.

## Impact

Unauthenticated or authenticated attacker can submit a long crafted email to trigger regex ReDoS, block the Node.js event loop, and cause service denial.

## Action

Patch when possible

## Recommendation

Upgrade to 8.6.115 or 9.10.7-alpha.1+; enforce email length limits and rate-limit signups/WAF rules.

## References

- [advisory] https://github.com/parse-community/parse-server/security/advisories/GHSA-9492-427f-466x
- [advisory] https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.7-alpha.1-redos-via-email-validation-regex

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.