CVE-2026-30925
published 2026-03-10CVE-2026-30925: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.45%
35.6th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps. This only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine. This vulnerability is fixed in 9.5.0-alpha.14 and 8.6.11.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 8.6.11 | 8.6.11 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 0 < 8.6.11 | 8.6.11 |
| parse-community | parse-server | >= 9.0.0-alpha.1 < 9.5.0-alpha.14 | 9.5.0-alpha.14 |
| parseplatform | parse-server | < 8.6.11 | 8.6.11 |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | >= 9.0.0 < 9.5.0 | 9.5.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
osv·2026-03-10
CVE-2026-30925 [HIGH] Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
### Impact
A malicious client can subscribe to a LiveQuery with a crafted `$regex` pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps.
This only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine.
### Patches
Regex evaluation in LiveQuery subscription matching now runs
GHSA
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
ghsa·2026-03-10
CVE-2026-30925 [HIGH] CWE-1333 Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
### Impact
A malicious client can subscribe to a LiveQuery with a crafted `$regex` pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps.
This only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine.
### Patches
Regex evaluation in LiveQuery subscription matching now runs
No detection rules found.
No public exploits indexed.
2026-03-10
Published