CVE-2026-47138 is a vulnerability in parse-community's parse-server involving inefficient regular expression complexity (CWE-1333) in the parsing of the client SDK version field within HTTP request headers. This parsing happens before session authentication and rate limiting on all /parse/* endpoints. An attacker who knows a public Parse Application ID can submit a single crafted HTTP request that triggers polynomial backtracking in the regex parser, causing the Node.js worker to spend seconds to minutes processing the request synchronously. This resource exhaustion can saturate workers with only a few concurrent requests, impacting service availability. The vulnerability affects production deployments running default configurations. The issue is fixed in versions 8.6.77 and 9.9.1-alpha.1.

The vulnerability allows unauthenticated attackers to cause denial of service by exhausting CPU resources on Node.js workers handling parse-server requests. Because the expensive regex parsing occurs before authentication and rate limiting, attackers can exploit this to degrade or disrupt service availability with minimal effort. This can lead to worker saturation and potential downtime for affected parse-server deployments.

A fix is available in parse-server versions 8.6.77 and 9.9.1-alpha.1. Users should upgrade to these or later versions to remediate this vulnerability. Since the vendor advisory does not specify alternative mitigations, upgrading is the recommended action. Patch status is confirmed by the vendor advisory stating the issue is fixed in these versions.