FKIE_CVE-2026-30925

Vulnerability from fkie_nvd - Published: 2026-03-10 17:40 - Updated: 2026-03-11 19:53
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps. This only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine. This vulnerability is fixed in 9.5.0-alpha.14 and 8.6.11.
References
security-advisories@github.comhttps://github.com/parse-community/parse-server/releases/tag/8.6.11Product, Release Notes
security-advisories@github.comhttps://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.14Product, Release Notes
security-advisories@github.comhttps://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5jMitigation, Patch, Vendor Advisory
Impacted products
Vendor Product Version
parseplatform parse-server *
parseplatform parse-server *
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
parseplatform parse-server 9.5.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "34762D4D-4428-4142-9C28-3C38B316E35B",
              "versionEndExcluding": "8.6.11",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "77A07A2F-C8ED-4D78-A9C0-66AB42F69F38",
              "versionEndExcluding": "9.5.0",
              "versionStartIncluding": "9.0.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha1:*:*:*:node.js:*:*",
              "matchCriteriaId": "3E9F95CF-EEE1-42FC-904E-321F05E3DE4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha10:*:*:*:node.js:*:*",
              "matchCriteriaId": "18465CD3-DB00-4A7C-99D9-8B841829EEE4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha11:*:*:*:node.js:*:*",
              "matchCriteriaId": "17BBDC30-3BA1-4608-B525-3E4753682FDE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha12:*:*:*:node.js:*:*",
              "matchCriteriaId": "384713D3-BD33-4021-AE0B-E752A2CC814E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha13:*:*:*:node.js:*:*",
              "matchCriteriaId": "518F4432-3E3D-4A97-973C-536D68D47928",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha2:*:*:*:node.js:*:*",
              "matchCriteriaId": "5C02D6F0-5A3A-45F5-8A74-F75A8CCAE7DE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha3:*:*:*:node.js:*:*",
              "matchCriteriaId": "103C9745-031B-4822-A19C-A61375FBB1AD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha4:*:*:*:node.js:*:*",
              "matchCriteriaId": "8D67029D-C1BD-4D46-A84F-C52B4D364268",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha5:*:*:*:node.js:*:*",
              "matchCriteriaId": "3B10930D-B416-4D9A-BA26-F0AD22BFAE28",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha6:*:*:*:node.js:*:*",
              "matchCriteriaId": "72794836-5CFB-4928-BB22-D7DE813809B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha7:*:*:*:node.js:*:*",
              "matchCriteriaId": "FA2C4C1E-3AE6-48E0-8B59-80554AE85BB0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha8:*:*:*:node.js:*:*",
              "matchCriteriaId": "40C8E499-E5C6-48DD-AE36-B73B2B6ADA67",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha9:*:*:*:node.js:*:*",
              "matchCriteriaId": "E92B2675-5D49-404B-BEC1-7037D6C1ACD5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps. This only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine. This vulnerability is fixed in 9.5.0-alpha.14 and 8.6.11."
    },
    {
      "lang": "es",
      "value": "Parse Server es un backend de c\u00f3digo abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de 9.5.0-alpha.14 y 8.6.11, un cliente malicioso puede suscribirse a una LiveQuery con un patr\u00f3n $regex manipulado que causa un retroceso catastr\u00f3fico, bloqueando el bucle de eventos de Node.js. Esto hace que todo el Parse Server no responda, afectando a todos los clientes. Cualquier despliegue de Parse Server con LiveQuery habilitado se ve afectado. El atacante solo necesita el ID de aplicaci\u00f3n y la clave de JavaScript, ambos son p\u00fablicos en las aplicaciones del lado del cliente. Esto solo afecta la coincidencia de suscripci\u00f3n de LiveQuery, que eval\u00faa expresiones regulares en JavaScript en el bucle de eventos de Node.js. Las consultas REST y GraphQL normales no se ven afectadas porque sus expresiones regulares son evaluadas por el motor de la base de datos. Esta vulnerabilidad est\u00e1 corregida en 9.5.0-alpha.14 y 8.6.11."
    }
  ],
  "id": "CVE-2026-30925",
  "lastModified": "2026-03-11T19:53:57.000",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-03-10T17:40:16.313",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/parse-community/parse-server/releases/tag/8.6.11"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "url": "https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.14"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1333"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.