CVE-2026-47138: Js Redos Adjacent Greedy Quantifiers On User Inputcve-2026-47138-js-redos-adjacent-greedy-quantifiers-on-user-input
Use of the Parse Server ClientSDK module (or an equivalent regex with two adjacent unbounded "+"-quantified character classes and no anchors, e.g. /([-a-zA-Z]+)([0-9\.]+)/) is susceptible to polynomial / catastrophic backtracking (ReDoS, CWE-1333). When the regex is applied to attacker-controlled input such as the X-Parse-Client-Version header or a _ClientVe
