Vulnerability in Parse-community Parse-server
CVE-2026-30925
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrop…
Vulnerability class: ReDoS (Regular Expression Denial of Service)
EPSS: 0.000 (6.0th percentile) — read the EPSS interpretation.
Affected products
- Parse-community Parse-server — versions >= 9.0.0 < 9.5.0-alpha.14, < 8.6.11
Weakness classification (CWE)
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j (x_refsource_CONFIRM)
- https://github.com/parse-community/parse-server/releases/tag/8.6.11 (x_refsource_MISC)
- https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.14 (x_refsource_MISC)