Parse Server: Denial of Service via unhandled email error

Summary

Parse Server does not handle errors raised while sending verification or password reset emails, so the server process exits. A client that holds only the public application keys can sign up, or request a verification or password reset email, while the mail provider rejects, rate limits or is unavailable. The attacker can repeat these requests to take the backend offline. Deployments that configure an email adapter with email verification or password reset are affected.

Affected

• parse-server before 8.6.97
• parse-server 9.0.0 before 9.10.2-alpha.6

Fixed in

• 8.x: 8.6.97
• 9.x: 9.10.2-alpha.6 per the vendor advisory (OSV lists 9.10.2; confirm the exact stable 9.x fix in the GHSA before upgrading)

Workaround

• Wrap the email adapter's send methods, and the sendUserEmailVerification function if configured, so they catch and log errors instead of throwing or rejecting.
• Register a process.on('unhandledRejection') listener that logs the rejection instead of letting it end the process, to also cover errors raised before the email adapter is called.

Exploitation

• No known exploitation in the wild; not listed in CISA KEV.
• CISA SSVC: exploitation none, automatable no, technical impact partial.
• Low EPSS score (0.00263). No public proof-of-concept found.

Our recommendation

• Inventory all Parse Server instances, their versions, and whether email verification or password reset is enabled.
• Upgrade to 8.6.97 or later on the 8.x branch, or to the fixed 9.x release confirmed in the GHSA advisory.
• Until patched, apply the workaround and rate-limit sign-up and reset endpoints at the reverse proxy or WAF.
• Monitor for unexpected process restarts and run the server under a process supervisor that alerts on restarts.
• Recheck the GHSA and NVD for updates, as NVD analysis is still pending.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-46jj-qw3p-48fc github.com
• VulnCheck advisory www.vulncheck.com
• OSV BIT-parse-2026-110854 osv.dev
• Parse Server release 9.10.2-alpha.6 github.com
• Parse Server pull request 10741 github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:12.