Executive brief
Parse Server is a backend platform that provides real-time data synchronization features via LiveQuery. A remote attacker can crash the server by subscribing to a LiveQuery with an invalid regular expression pattern, causing the entire server process to terminate and disrupting service for all connected clients. No authentication is required to exploit this vulnerability.
Technical details
The vulnerability is an improper input validation (CWE-20) in Parse Server's LiveQuery subscription handler. When a subscription request contains an invalid regular expression pattern, the pattern is accepted and later processed by the regex engine during subscription matching, causing an unhandled exception that crashes the server process. The attack requires network access but no authentication or user interaction. The fix validates regex patterns at subscription time and adds defensive try-catch blocks to prevent subscription matching errors from terminating the process. Patches are available in versions 8.6.43 and 9.6.0-alpha.19 and later.
Affected products
- Parse Community Parse Server versions 8.x before 8.6.43 and 9.0.0 through 9.6.0-alpha.18
Timeline
- 2026-03-17: disclosed: GHSA-827p-g5x5-h86c published
- 2026-03-17: patched: Fixes released in versions 8.6.43 and 9.6.0-alpha.19