CVE-2026-30835 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6, malformed $regex query parameter (e.g. [abc) causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals such as error messages, error codes, code names, cluster timestamps, and topology details. The vulnerability is exploitable by any client that can send query requests, depending on the deployment's permission configuration. This issue has been patched in versions 8.6.7 and 9.5.0-alpha.6.
A vulnerability in Parse Server prior to versions 8.6.7 and 9.5.0-alpha.6 allows for the leakage of database error details through the API response. This issue arises when a malformed $regex query parameter is sent, causing the database to return an unsanitized structured error object. The leaked information includes internal database details such as error messages, error codes, code names, cluster timestamps, and topology information. The vulnerability can be exploited by any client capable of sending query requests, depending on the deployment's permission settings.
Users can upgrade to Parse Server versions 8.6.7 or 9.5.0-alpha.6 to address this vulnerability. The error leakage issue has been fixed by sanitizing database error objects before they are sent to clients, ensuring that only a generic error message is exposed while detailed errors are logged on the server side.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/releases/tag/8.6.7 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.6 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-9cp7-3q5w-j92g | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-209 | Generation of Error Message Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.7 >= 9.0.0, < 9.5.0 9.5.0 alpha1 9.5.0 alpha2 9.5.0 alpha3 9.5.0 alpha4 9.5.0 alpha5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 6, 2026 | New CVE Received | [email protected] |