Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps. This only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine. This vulnerability is fixed in 9.5.0-alpha.14 and 8.6.11.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
| Date | Total | Labels |
|---|
| 2026-03-10 | 4 | Disclosure2General2 |
| 2026-03-18 | 1 | Disclosure1 |
CVE-2026-30925 Denial of Service via Regex Backtracking in Parse Server LiveQuery https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-30925
Post summary
The entry announces CVE‑2026‑30925 as a Denial‑of‑Service vulnerability caused by regex backtracking in Parse Server LiveQuery, providing technical details but no PoC, exploit, or patch information.
🔴 Parse Server, Denial of Service via ReDoS, #CVE-2026-30925 (High) https://dailycve.com/parse-server-denial-of-service-via-redos-cve-2026-30925-high/
Post summary
The post announces a high‑severity Denial‑of‑Service vulnerability (CVE‑2026‑30925) in Parse Server, describing it as a Regular Expression Denial of Service (ReDoS). No PoC, patch, or active exploitation details are provided.
🚨*CVE* CVE-2026-30925 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can sub… https://www.cve.org/CVERecord?id=CVE-2026-30925 ----- Traducción: CVE-2026-30925 Par… http://infoflow.cloud`
Post summary
The post references CVE-2026-30925 for Parse Server and directs readers to the official CVE record, but provides no additional details about exploitation, patches, or PoC.
CVE-2026-30925 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can sub… https://www.cve.org/CVERecord?id=CVE-2026-30925
Post summary
A brief CVE notice stating that prior to Parse Server 9.5.0‑alpha.14 and 8.6.11 a malicious client can exploit the system, but no further technical or mitigation details are provided.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-30925 - Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery Intel Report: https://ift.tt/OVDkdeu
Post summary
The tweet announces CVE-2026-30925 as a ReDoS vulnerability in Parse Server's LiveQuery, providing minimal technical detail but lacking evidence of exploitation, PoC, or patch information.
14 of 14 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | parseplatform | parse-server | - | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |
| App | parseplatform | parse-server | 9.5.0 | node.js | - |