CVE-2026-30835Disclosure(parseplatform / parse-server)

LOWCVSS 5.3 · MEDIUM

Signal is active with 3 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6, malformed $regex query parameter (e.g. [abc) causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals such as error messages, error codes, code names, cluster timestamps, and topology details. The vulnerability is exploitable by any client that can send query requests, depending on the deployment's permission configuration. This issue has been patched in versions 8.6.7 and 9.5.0-alpha.6.

parseplatform CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Patch / fix

https://github.com/parse-community/parse-server/security/advisories/GHSA-9cp7-3q5w-j92g

Other references

Weakness type (CWE)

CWE-209

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

parse-server

Threat summary

4 mentions across 2 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
Peaked at 3 mentions on most recent observed day (2026-03-07)
4 total mentions across 2 days

Affected systems

Vendors

parseplatform

Products

parse-server

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 2d

Signal classification1 categories

Disclosure

4100.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-06	1	Disclosure1
2026-03-07	3	Disclosure3

Full discourse4 posts

CVE@CVEnew215d
Disclosure
CVE-2026-30835 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6, malformed $regex q… https://www.cve.org/CVERecord?id=CVE-2026-30835
Post summary
The snippet reveals that Parse Server versions prior to 8.6.7 and 9.5.0-alpha.6 are susceptible to malformed $regex queries, providing limited technical details but no PoC, exploit, or active exploitation evidence.
00000115
56.6K followersView on X
Vulmon Vulnerability Feed@VulmonFeeds215d
Disclosure
CVE-2026-30835 Parse Server Regex Query Vulnerability Exposes Database Internals via Unsanitized Error Response https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30835
Post summary
The post announces the discovery of CVE‑2026‑30835, detailing how unsanitized error responses in Parse Server expose database internals, without mentioning PoC, exploit code, active abuse, or remediation steps.
0000038
4.0K followersView on X
DailyCVE@dailycve216d
Disclosure
🟠 Parse Server, Information Disclosure, #CVE-2026-30835 (Medium) https://dailycve.com/parse-server-information-disclosure-cve-2026-30835-medium/
Post summary
The text announces a new information disclosure vulnerability (CVE‑2026‑30835) affecting Parse Server with a Medium CVSS score, but provides no PoC, exploit, or mitigation details.
0000044
166 followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash216d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30835 - Parse Server: Malformed `$regex` query leaks database error details in API response Intel Report: https://ift.tt/h4LoAg9
Post summary
The alert reports CVE-2026-30835 on Parse Server, noting that malformed `$regex` queries leak database error details in API responses, marking it as a disclosed vulnerability with no available exploit or patch information yet.
0000062
343 followersView on X

CPE platform detail6 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

6 of 6 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	parseplatform	parse-server	-	node.js	-
App	parseplatform	parse-server	9.5.0	node.js	-
App	parseplatform	parse-server	9.5.0	node.js	-
App	parseplatform	parse-server	9.5.0	node.js	-
App	parseplatform	parse-server	9.5.0	node.js	-
App	parseplatform	parse-server	9.5.0	node.js	-

Explore more

Back to dashboard parseplatform CVEs parse-server vulnerabilities

What researchers are saying

CVE-2026-30835

CVE@CVEnewDisclosure

The snippet reveals that Parse Server versions prior to 8.6.7 and 9.5.0-alpha.6 are susceptible to malformed $regex queries, providing limited technical details but no PoC, exploit, or active exploitation evidence.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces the discovery of CVE‑2026‑30835, detailing how unsanitized error responses in Parse Server expose database internals, without mentioning PoC, exploit code, active abuse, or remediation steps.

DailyCVE@dailycveDisclosure

The text announces a new information disclosure vulnerability (CVE‑2026‑30835) affecting Parse Server with a Medium CVSS score, but provides no PoC, exploit, or mitigation details.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The alert reports CVE-2026-30835 on Parse Server, noting that malformed `$regex` queries leak database error details in API responses, marking it as a disclosed vulnerability with no available exploit or patch information yet.