Threats tagged 'ghsa-r7pw-r949-xvmf'

Parse Server versions before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 contain a vulnerability in the email address validation logic. The validation uses a regular expression with quadratic runtime complexity and no length limit, allowing an attacker to craft a long email address that blocks the Node.js event loop. This results in a denial of service affecting all clients.