CVE-2026-30835: Parse Server Malformed $regex Query Leads to Database Error Leakage
Summary
CVE-2026-30835: Parse Server: Malformed $regex query leaks database error details in API response. Affects parse versions < 9.5.0. Fixed in 9.5.0. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-30835 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that allows developers to build applications using Node.js. It provides a robust set of features, including a database, user authentication, and real-time capabilities. However, it is susceptible to vulnerabilities, particularly when handling malformed queries, which can expose sensitive internal information.
Vulnerability Detail
The vulnerability arises from the handling of malformed $regex query parameters in Parse Server versions prior to 8.6.7 and 9.5.0. When such a query is executed, the database returns a structured error object that is not sanitized before being sent back through the API response. This can lead to the exposure of sensitive database internals, including error messages, error codes, and other metadata that could be exploited by malicious actors. The risk is particularly high for any client that can send query requests, depending on the permission settings of the deployment.
How To Fix
Minimum fixed version
9.5.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your API does not expose detailed error messages in responses. You can implement error handling middleware that sanitizes error responses before sending them to clients. For example:
app.use((err, req, res, next) => {
res.status(err.status || 500).send({ message: 'An error occurred' });
});
Conclusion
CVE-2026-30835 is a significant vulnerability in Parse Server that can lead to the leakage of sensitive database information through malformed $regex queries. Updating to the latest versions is crucial for maintaining the security of applications using Parse Server. Implementing proper error handling can also mitigate risks until updates are applied.
See every vulnerability recorded for parse →
FAQ
CVE-2026-30835 is a vulnerability in Parse Server that allows malformed $regex queries to leak sensitive database error details through API responses.
If you are using Parse Server versions prior to 8.6.7 or 9.5.0, your application may be vulnerable. You can check your version in your package.json or package-lock.json file.
The vulnerability can lead to the exposure of sensitive database information, which could be exploited by attackers to gain insights into your database structure and potentially compromise your application.
Yes, you can use Vulert, which monitors open-source vulnerabilities in your software by analyzing your manifest files like package-lock.json. You can check for vulnerabilities in real-time without needing to install any software.
You can update Parse Server by running the command npm install parse@latest in your terminal, ensuring you have the latest patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
