{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-22T18:55:34.170","vulnerabilities":[{"cve":{"id":"CVE-2026-30925","sourceIdentifier":"security-advisories@github.com","published":"2026-03-10T17:40:16.313","lastModified":"2026-03-11T19:53:57.000","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps. This only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine. This vulnerability is fixed in 9.5.0-alpha.14 and 8.6.11."},{"lang":"es","value":"Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de 9.5.0-alpha.14 y 8.6.11, un cliente malicioso puede suscribirse a una LiveQuery con un patrón $regex manipulado que causa un retroceso catastrófico, bloqueando el bucle de eventos de Node.js. Esto hace que todo el Parse Server no responda, afectando a todos los clientes. Cualquier despliegue de Parse Server con LiveQuery habilitado se ve afectado. El atacante solo necesita el ID de aplicación y la clave de JavaScript, ambos son públicos en las aplicaciones del lado del cliente. Esto solo afecta la coincidencia de suscripción de LiveQuery, que evalúa expresiones regulares en JavaScript en el bucle de eventos de Node.js. Las consultas REST y GraphQL normales no se ven afectadas porque sus expresiones regulares son evaluadas por el motor de la base de datos. Esta vulnerabilidad está corregida en 9.5.0-alpha.14 y 8.6.11."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Primary","description":[{"lang":"en","value":"CWE-1333"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*","versionEndExcluding":"8.6.11","matchCriteriaId":"34762D4D-4428-4142-9C28-3C38B316E35B"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*","versionStartIncluding":"9.0.0","versionEndExcluding":"9.5.0","matchCriteriaId":"77A07A2F-C8ED-4D78-A9C0-66AB42F69F38"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha1:*:*:*:node.js:*:*","matchCriteriaId":"3E9F95CF-EEE1-42FC-904E-321F05E3DE4E"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha10:*:*:*:node.js:*:*","matchCriteriaId":"18465CD3-DB00-4A7C-99D9-8B841829EEE4"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha11:*:*:*:node.js:*:*","matchCriteriaId":"17BBDC30-3BA1-4608-B525-3E4753682FDE"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha12:*:*:*:node.js:*:*","matchCriteriaId":"384713D3-BD33-4021-AE0B-E752A2CC814E"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha13:*:*:*:node.js:*:*","matchCriteriaId":"518F4432-3E3D-4A97-973C-536D68D47928"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha2:*:*:*:node.js:*:*","matchCriteriaId":"5C02D6F0-5A3A-45F5-8A74-F75A8CCAE7DE"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha3:*:*:*:node.js:*:*","matchCriteriaId":"103C9745-031B-4822-A19C-A61375FBB1AD"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha4:*:*:*:node.js:*:*","matchCriteriaId":"8D67029D-C1BD-4D46-A84F-C52B4D364268"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha5:*:*:*:node.js:*:*","matchCriteriaId":"3B10930D-B416-4D9A-BA26-F0AD22BFAE28"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha6:*:*:*:node.js:*:*","matchCriteriaId":"72794836-5CFB-4928-BB22-D7DE813809B4"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha7:*:*:*:node.js:*:*","matchCriteriaId":"FA2C4C1E-3AE6-48E0-8B59-80554AE85BB0"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha8:*:*:*:node.js:*:*","matchCriteriaId":"40C8E499-E5C6-48DD-AE36-B73B2B6ADA67"},{"vulnerable":true,"criteria":"cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha9:*:*:*:node.js:*:*","matchCriteriaId":"E92B2675-5D49-404B-BEC1-7037D6C1ACD5"}]}]}],"references":[{"url":"https://github.com/parse-community/parse-server/releases/tag/8.6.11","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.14","source":"security-advisories@github.com","tags":["Product","Release Notes"]},{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j","source":"security-advisories@github.com","tags":["Mitigation","Patch","Vendor Advisory"]}]}}]}