CVE-2026-32770

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process terminates when the invalid pattern reaches the regex engine during subscription matching, causing denial of service for all connected clients. The fix in 9.6.0-alpha.19 and 8.6.43 validates regular expression patterns at subscription time, rejecting invalid patterns before they are stored. Additionally, a defense-in-depth try-catch prevents any subscription matching error from crashing the server process. As a workaround, disable LiveQuery if it is not needed.

• CWE-248

• https://github.com/parse-community/parse-server/pull/10197Issue Tracking
• https://github.com/parse-community/parse-server/pull/10199Issue Tracking
• https://github.com/parse-community/parse-server/security/advisories/GHSA-827p-g5x5-h86cVendor Advisory

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32765Rejected reason: This repository is no longer public.
• CVE-2026-32766astral-tokio-tar is a tar archive reading/writing library fo…5.3
• CVE-2026-32767SiYuan is a personal knowledge management system. Versions 3…9.8
• CVE-2026-32768Chall-Manager is a platform-agnostic system able to start Ch…9.9
• CVE-2026-32769Fullchain is an umbrella project for deploying a ready-to-us…9.8
• CVE-2026-3277The OpenID Connect (OIDC) authentication configuration in Po…6.5
• CVE-2026-32771The CTFer.io Monitoring component is in charge of the collec…9.8
• CVE-2026-32772telnet in GNU inetutils through 2.7 allows servers to read a…4.7
• CVE-2026-32774Vulnogram 1.0.0 contains a stored cross-site scripting vulne…5.4
• CVE-2026-32775libexif through 0.6.25 has a flaw in decoding MakerNotes. If…7.8
• CVE-2026-32776libexpat before 2.7.5 allows a NULL pointer dereference with…5.5
• CVE-2026-32777libexpat before 2.7.5 allows an infinite loop while parsing …5.5