CVE-2026-30925: Parse Server Regular Expression Denial of Service (ReDoS) Vulnerability

Background

Parse Server is an open-source backend platform that enables developers to build applications without managing their own server infrastructure. It provides features such as data storage, user authentication, and real-time capabilities through LiveQuery. However, the implementation of regex in LiveQuery can lead to performance issues if not properly managed, making it susceptible to Denial of Service attacks.

Vulnerability Detail

The vulnerability arises from the ability of a malicious client to subscribe to a LiveQuery using a specially crafted $regex pattern that causes catastrophic backtracking. This can block the Node.js event loop, rendering the entire Parse Server unresponsive and affecting all connected clients. The attacker only needs the application ID and JavaScript key, which are typically public in client-side applications. This issue specifically impacts LiveQuery subscription matching, as opposed to REST and GraphQL queries, which are processed by the database engine.

npm install parse-server@9.10.5

Workaround

As a temporary workaround, you can use the beforeSubscribe Cloud Code hook to reject any LiveQuery subscription that contains a $regex operator. Here is an example code snippet:

// Repeat for each class that is used with LiveQuery
Parse.Cloud.beforeSubscribe('MyClass', request => {
  const where = request.query._where || {};
  for (const value of Object.values(where)) {
    if (value?.$regex) {
      throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, '$regex not allowed in LiveQuery subscriptions');
    }
  }
});

Conclusion

The CVE-2026-30925 vulnerability in Parse Server poses a significant risk due to its potential for Denial of Service attacks via crafted regex patterns in LiveQuery subscriptions. It is crucial to update to the patched versions or implement the suggested workarounds to mitigate this risk.

See every vulnerability recorded for parse-server →

FAQ