CVE-2026-32770 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process terminates when the invalid pattern reaches the regex engine during subscription matching, causing denial of service for all connected clients. The fix in 9.6.0-alpha.19 and 8.6.43 validates regular expression patterns at subscription time, rejecting invalid patterns before they are stored. Additionally, a defense-in-depth try-catch prevents any subscription matching error from crashing the server process. As a workaround, disable LiveQuery if it is not needed.
A denial-of-service vulnerability has been identified in Parse Server versions prior to 9.6.0-alpha.19 and 8.6.43. The issue arises when a remote attacker subscribes to a LiveQuery using an invalid regular expression pattern. This causes the server process to crash as the invalid pattern is processed by the regex engine during subscription matching, disrupting service for all connected clients. The vulnerability has been addressed in versions 9.6.0-alpha.19 and 8.6.43 by implementing pattern validation at subscription time, rejecting invalid patterns before they can be stored. Additionally, a try-catch mechanism has been introduced to prevent subscription matching errors from terminating the server process. As a temporary measure, LiveQuery can be disabled if not needed.
Users can upgrade to Parse Server versions 9.6.0-alpha.19 or 8.6.43, where this vulnerability has been patched. If an immediate upgrade is not possible, LiveQuery can be disabled as a workaround.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/pull/10197 | [email protected] | Issue Tracking |
| https://github.com/parse-community/parse-server/pull/10199 | [email protected] | Issue Tracking |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-827p-g5x5-h86c | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.43 >= 9.0.0, < 9.6.0 9.6.0 alpha1 9.6.0 alpha10 9.6.0 alpha11 9.6.0 alpha12 9.6.0 alpha13 9.6.0 alpha14 9.6.0 alpha15 9.6.0 alpha16 9.6.0 alpha17 9.6.0 alpha18 9.6.0 alpha2 9.6.0 alpha3 9.6.0 alpha4 9.6.0 alpha5 9.6.0 alpha6 9.6.0 alpha7 9.6.0 alpha8 9.6.0 alpha9 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |