CVE-2026-30925

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps. This only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine. This vulnerability is fixed in 9.5.0-alpha.14 and 8.6.11.

• CWE-1333

• https://github.com/parse-community/parse-server/releases/tag/8.6.11Product, Release Notes
• https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.14Product, Release Notes
• https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5jMitigation, Patch, Vendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30919facileManager is a modular suite of web apps built with the …5.4
• CVE-2026-30920OneUptime is a solution for monitoring and managing online s…8.6
• CVE-2026-30921OneUptime is a solution for monitoring and managing online s…9.9
• CVE-2026-30922pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3…7.5
• CVE-2026-30923ModSecurity is an open source, cross platform web applicatio…7.5
• CVE-2026-30924qui is a web interface for managing qBittorrent instances. V…9.6
• CVE-2026-30926SiYuan is a personal knowledge management system. Prior to 3…7.1
• CVE-2026-30927Admidio is an open-source user management solution. Prior to…5.4
• CVE-2026-30928Glances is an open-source system cross-platform monitoring t…7.5
• CVE-2026-30929ImageMagick is free and open-source software used for editin…7.8
• CVE-2026-3093GitLab has remediated an issue in GitLab CE/EE affecting all…4.7
• CVE-2026-30930Glances is an open-source system cross-platform monitoring t…9.8