{"id":"EUVD-2026-36535","enisaUuid":"5967052d-fc0d-36ca-b18b-c63caf5eef84","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.77 and 9.9.1-alpha.1, an unauthenticated attacker who knows a publicly-known Parse Application ID can submit a single HTTP request whose client SDK version field contains adversarial input that triggers polynomial backtracking in a request-header parser. The parsing runs before session authentication and before rate limiting on every /parse/* request, so the request consumes seconds to minutes of synchronous CPU on a Node.js worker before any access control evaluates it. A small number of concurrent requests can saturate a worker; a single large request via the body-field variant can pin a worker for minutes. Production deployments running the default configuration are affected. This issue has been patched in versions 8.6.77 and 9.9.1-alpha.1.","datePublished":"Jun 12, 2026, 6:22:02 PM","dateUpdated":"Jun 12, 2026, 6:56:14 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm\nhttps://github.com/parse-community/parse-server/pull/10463\nhttps://github.com/parse-community/parse-server/pull/10464\n","aliases":"CVE-2026-47138\nGHSA-38m6-82c8-4xfm\n","assigner":"GitHub_M","epss":0.58,"enisaIdProduct":[{"id":"84e05a60-cab7-38cf-b2e9-1ae45764a538","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.77"},{"id":"ec95d9e8-2647-3992-ab1c-6e1337cb90aa","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0, \u003c 9.9.1-alpha.1"}],"enisaIdVendor":[{"id":"52c15895-b8d2-39d6-8207-08648b2173fe","vendor":{"name":"parse-community"}}],"enisaIdVulnerability":[{"id":"1ff42dde-6756-3514-b087-1d413af4bb32","vulnerability":{"id":"GHSA-38m6-82c8-4xfm","description":"Parse Server: Pre-authentication denial of service via client version header regex backtracking","datePublished":"May 23, 2026, 12:11:25 AM","dateUpdated":"Jun 12, 2026, 9:59:40 PM","baseScore":0.0,"references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47138\nhttps://github.com/parse-community/parse-server/pull/10463\nhttps://github.com/parse-community/parse-server/pull/10464\nhttps://github.com/parse-community/parse-server\n","enisa_id":"EUVD-2026-36535\n","aliases":"GHSA-38m6-82c8-4xfm\nCVE-2026-47138\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"bf8c0db4-729d-3f4e-89de-92d79838bb5e","vulnerability":{"id":"CVE-2026-47138","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.77 and 9.9.1-alpha.1, an unauthenticated attacker who knows a publicly-known Parse Application ID can submit a single HTTP request whose client SDK version field contains adversarial input that triggers polynomial backtracking in a request-header parser. The parsing runs before session authentication and before rate limiting on every /parse/* request, so the request consumes seconds to minutes of synchronous CPU on a Node.js worker before any access control evaluates it. A small number of concurrent requests can saturate a worker; a single large request via the body-field variant can pin a worker for minutes. Production deployments running the default configuration are affected. This issue has been patched in versions 8.6.77 and 9.9.1-alpha.1.","datePublished":"Jun 12, 2026, 6:22:02 PM","dateUpdated":"Jun 12, 2026, 6:56:14 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm\nhttps://github.com/parse-community/parse-server/pull/10463\nhttps://github.com/parse-community/parse-server/pull/10464\n","enisa_id":"EUVD-2026-36535\n","assigner":"GitHub_M","epss":0.58,"dataProcessed":"Nov 3, 2026, 7:18:19 AM","vulnerabilityProduct":[{"id":"0839f0fa-8088-3821-82f5-f3702115e52b","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0, \u003c 9.9.1-alpha.1"},{"id":"77400e5b-e709-3e7b-8dc5-6283322b31fc","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.77"}],"vulnerabilityVendor":[{"id":"ec2c9e0e-da22-3312-a160-127e7ef47826","vendor":{"name":"parse-community"}}]}}],"enisaIdAdvisory":[]}