Parse Server: Pre-authentication denial of service via client version header regex backtracking
- Severity:
- High
Description
An unauthenticated attacker who knows a publicly-known Parse Application ID can submit a single HTTP request whose client SDK version field contains adversarial input that triggers polynomial backtracking in a request-header parser.
Recommendation
Update the parse-server package to the latest compatible version. Followings are version details:
Affected version(s): **< 8.6.77 >= 9.0.0, < 9.9.1-alpha.1** Patched version(s): **8.6.77 9.9.1-alpha.1**
References
Related Issues
- Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery - CVE-2026-30925
- Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939
- Parse Server: Denial of Service via unindexed database query for unconfigured auth providers - CVE-2026-33538
- Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API - CVE-2026-30946
You might also like:
- Tags:
- npm
- parse-server
Anything's wrong? Let us know Last updated on May 23, 2026