CVE-2026-47138 Details

A denial-of-service vulnerability has been identified in Parse Server, an open-source backend that runs on Node.js. This issue affects versions 9.0.0 prior to 9.9.1-alpha.1 and versions prior to 8.6.77. The vulnerability allows an unauthenticated attacker who knows a publicly-known Parse Application ID to send a single HTTP request that exploits the client SDK version field. This adversarial input triggers polynomial backtracking in the request-header parser, causing significant CPU consumption on a Node.js worker. The parsing occurs before session authentication and rate limiting on all '/parse/*' requests, leading to potential worker saturation. In production deployments with the default configuration, a small number of concurrent requests can overwhelm a worker, while a single large request through the body-field variant can immobilize a worker for several minutes.

Users are advised to upgrade to Parse Server versions 8.6.77 or 9.9.1-alpha.1, where this vulnerability has been patched. Additionally, for those unable to upgrade immediately, deploying a reverse proxy or Web Application Firewall (WAF) to strip or strictly size-limit the 'X-Parse-Client-Version' header and the '_ClientVersion' field in JSON request bodies on all '/parse/*' routes before reaching the server can serve as a temporary workaround.