8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-47138

CVE-2026-47138: Parse Server: Pre-authentication denial of service via client version header regex backtracking

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.77 and 9.9.1-alpha.1, an unauthenticated attacker who knows a publicly-known Parse Application ID can submit a single HTTP request whose client SDK version field contains adversarial input that triggers polynomial backtracking in a request-header parser. The parsing runs before session authentication and before rate limiting on every /parse/* request, so the request consumes seconds to minutes of synchronous CPU on a Node.js worker before any access control evaluates it. A small number of concurrent requests can saturate a worker; a single large request via the body-field variant can pin a worker for minutes. Production deployments running the default configuration are affected. This issue has been patched in versions 8.6.77 and 9.9.1-alpha.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-47138

CVE-2026-47138:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.9.1-alpha.1	9.9.1-alpha.1
parse-server	npm	< 8.6.77	8.6.77

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a pre-authentication denial of service in Parse Server, caused by a regular expression susceptible to polynomial backtracking (ReDoS). The root cause lies in the fromString function within the now-removed src/ClientSDK.js file. This function used the regex /([-a-zA-Z]+)([0-9\\.]+)/ to parse the client SDK version from incoming requests.

The primary execution path for this vulnerability is through the handleParseHeaders middleware. This function is triggered on every request to a /parse/* endpoint. It extracts the client version from either the X-Parse-Client-Version HTTP header or the _ClientVersion field in the JSON body and passes it to the vulnerable fromString function. An attacker can send a specially crafted string (e.g., a long sequence of hyphens) that causes the regex engine to enter a state of catastrophic backtracking, consuming significant CPU resources for an extended period and effectively causing a denial of service.

An additional, less direct path exists through the RestWrite._updateResponseWithData method, which calls ClientSDK.supportsForwardDelete, a function that also depends on the vulnerable fromString parser. The patch remediates the vulnerability by completely removing the client version parsing logic, including the ClientSDK.js file and all calls to it, thereby eliminating the vulnerable regex and the attack vector.

Vulnerable functions

fromString

src/ClientSDK.js

This function contains a regular expression vulnerable to polynomial backtracking (ReDoS). The regex `([-a-zA-Z]+)([0-9\\.]+)` can be exploited by sending a crafted string that causes catastrophic backtracking, leading to high CPU usage and a denial of service. The entire file containing this function was removed in the patch.

handleParseHeaders

src/middlewares.js

This middleware function is the primary entry point for the vulnerability. It extracts the client version string from the 'X-Parse-Client-Version' header or the '_ClientVersion' field in the request body. It then passes this string to the vulnerable `fromString` function for parsing. Since this middleware runs before authentication and rate limiting, it allows unauthenticated attackers to trigger the ReDoS.

RestWrite._updateResponseWithData

src/RestWrite.js

This function, while not the primary entry point, also utilizes the vulnerable client SDK parsing logic. It calls `ClientSDK.supportsForwardDelete`, which in turn calls the vulnerable `fromString` function. This represents another potential code path through which the ReDoS vulnerability could be triggered during a write operation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.