Parse Server’s request parser performs a regular‑expression match on the client SDK version supplied in a header before authenticating the request. An attacker who knows a public Parse Application ID can supply an adversarial value that triggers deep backtracking, causing the parser to consume a large amount of CPU time. This leads to a denial of service by exhausting the Node.js worker that processes the request, with the effect that legitimate traffic is delayed or blocked while the worker remains tied up. The weakness is a classic regex‑exponential‑backtracking flaw (CWE‑1333).

The vulnerability affects the open‑source Parse Server (parse-community:parse-server) prior to version 8.6.77 and the 9.9.1‑alpha.1 release or earlier. Production deployments that rely on the default configuration are included. Upgrading to 8.6.77, 9.9.1‑alpha.1, or later versions resolves the problem.

With a CVSS score of 8.7 the flaw is considered high severity. The EPSS score is less than 1%, indicating a low probability of widespread exploitation at the current moment, and the vulnerability is not listed in CISA’s KEV catalog. However, the attack requires no credentials and only a known public Application ID, which is typically publicly available. Anyone able to send crafted requests to any /parse/* endpoint can trigger the CPU exhaustion, and a small number of concurrent requests can saturate a worker. Because the vulnerable code path executes before authentication and before rate limiting, the attacker can observe the effect immediately and launch repetitive attacks without needing to bypass any protections.