CVE-2026-30835
published 2026-03-06CVE-2026-30835: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6, malformed…
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.34%
25.3th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6, malformed $regex query parameter (e.g. [abc) causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals such as error messages, error codes, code names, cluster timestamps, and topology details. The vulnerability is exploitable by any client that can send query requests, depending on the deployment's permission configuration. This issue has been patched in versions 8.6.7 and 9.5.0-alpha.6.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 8.6.7 | 8.6.7 |
| parse-community | parse-server | < 9.5.0-alpha.6 | 9.5.0-alpha.6 |
| parse-community | parse-server | >= 0 < 8.6.7 | 8.6.7 |
| parse-community | parse-server | >= 9.0.0 < 9.5.0-alpha.6 | 9.5.0-alpha.6 |
| parseplatform | parse-server | < 8.6.7 | 8.6.7 |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | >= 9.0.0 < 9.5.0 | 9.5.0 |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
parse-server: Malformed `$regex` query leaks database error details in API response
osv·2026-03-06
CVE-2026-30835 [MEDIUM] parse-server: Malformed `$regex` query leaks database error details in API response
parse-server: Malformed `$regex` query leaks database error details in API response
### Impact
A malformed $regex query parameter (e.g. `[abc)` causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals such as error messages, error codes, code names, cluster timestamps, and topology details. The vulnerability is exploitable by any client that can send query requests, depending on the deployment's permission configuration.
### Patches
The fix sanitizes database error objects so that only a generic `"An internal server error occurred"` message is returned to clients, while the detailed error is logged server-side. The fix respects the `enableSanitizedErrorResponse` server option.
### Workarounds
There is n
GHSA
parse-server: Malformed `$regex` query leaks database error details in API response
ghsa·2026-03-06
CVE-2026-30835 [MEDIUM] CWE-209 parse-server: Malformed `$regex` query leaks database error details in API response
parse-server: Malformed `$regex` query leaks database error details in API response
### Impact
A malformed $regex query parameter (e.g. `[abc)` causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals such as error messages, error codes, code names, cluster timestamps, and topology details. The vulnerability is exploitable by any client that can send query requests, depending on the deployment's permission configuration.
### Patches
The fix sanitizes database error objects so that only a generic `"An internal server error occurred"` message is returned to clients, while the detailed error is logged server-side. The fix respects the `enableSanitizedErrorResponse` server option.
### Workarounds
There is n
No detection rules found.
No public exploits indexed.
2026-03-06
Published