CVE-2026-30925: Parse Server LiveQuery DoS Vulnerability

CVE-2026-30925 Overview

Parse Server, an open source backend that can be deployed to any infrastructure running Node.js, contains a Regular Expression Denial of Service (ReDoS) vulnerability in its LiveQuery feature. Prior to versions 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop and rendering the entire Parse Server unresponsive.

Critical Impact
Any Parse Server deployment with LiveQuery enabled is vulnerable. An attacker only needs the application ID and JavaScript key—both of which are publicly exposed in client-side applications—to exploit this vulnerability and cause a complete denial of service affecting all connected clients.

Affected Products

Parse Server versions prior to 8.6.11
Parse Server versions 9.5.0-alpha.1 through 9.5.0-alpha.13
Any Parse Server deployment with LiveQuery enabled running on Node.js

Discovery Timeline

2026-03-10 - CVE-2026-30925 published to NVD
2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-30925

Vulnerability Analysis

This vulnerability is classified as CWE-1333 (Inefficient Regular Expression Complexity), commonly known as Regular Expression Denial of Service (ReDoS). The flaw exists in how Parse Server's LiveQuery subscription matching evaluates regular expressions. Unlike normal REST and GraphQL queries where regex patterns are evaluated by the database engine, LiveQuery subscription matching evaluates regex directly in JavaScript on the Node.js event loop.

Node.js operates on a single-threaded event loop model, meaning any blocking operation prevents all other requests from being processed. When a malicious client submits a carefully crafted regex pattern through a LiveQuery subscription, the pattern triggers catastrophic backtracking during evaluation. This exponential time complexity causes the regex engine to consume excessive CPU cycles, effectively freezing the entire server.

The attack is particularly concerning because it requires minimal attacker prerequisites—only the application ID and JavaScript key, which are inherently exposed in client-side applications that use Parse Server as their backend.

Root Cause

The root cause is insufficient validation and sanitization of user-supplied regular expression patterns in the LiveQuery subscription handling code. When a client creates a LiveQuery subscription with a $regex operator, the pattern is evaluated directly by the JavaScript regex engine without complexity analysis or timeout constraints. This allows specially crafted patterns with nested quantifiers or overlapping alternations to trigger exponential backtracking behavior.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication beyond the publicly available application ID and JavaScript key. An attacker can craft a malicious LiveQuery subscription request containing a regex pattern designed to cause catastrophic backtracking. When the server processes this subscription and attempts to match data against the malicious pattern, the regex evaluation consumes all available CPU resources, blocking the Node.js event loop and denying service to all legitimate clients.

The attack can be executed remotely by any client with access to the Parse Server's LiveQuery WebSocket endpoint. Since the application ID and JavaScript key are typically embedded in client-side code for mobile and web applications, obtaining these credentials is trivial for an attacker.

Detection Methods for CVE-2026-30925

Indicators of Compromise

Sudden and sustained CPU utilization spikes on Parse Server instances
Unresponsive Parse Server with clients experiencing connection timeouts
LiveQuery WebSocket connections from suspicious or unknown sources
Unusual $regex patterns in LiveQuery subscription logs

Detection Strategies

Monitor Node.js event loop lag metrics for abnormal delays exceeding baseline thresholds
Implement logging and alerting for LiveQuery subscriptions containing $regex operators
Review WebSocket connection logs for patterns indicative of automated attack attempts
Deploy application performance monitoring (APM) to detect sudden degradation in request processing times

Monitoring Recommendations

Enable verbose logging for LiveQuery subscription requests, including the query parameters
Configure alerts for CPU utilization exceeding normal operational thresholds on Parse Server hosts
Monitor WebSocket connection counts and identify anomalous connection patterns
Implement health checks that detect event loop blocking conditions

How to Mitigate CVE-2026-30925

Immediate Actions Required

Upgrade Parse Server to version 8.6.11 or 9.5.0-alpha.14 or later immediately
Audit existing LiveQuery subscriptions for potentially malicious regex patterns
Consider temporarily disabling LiveQuery functionality if patching cannot be performed immediately
Review and restrict network access to LiveQuery endpoints where possible

Patch Information

Parse Platform has released security patches addressing this vulnerability. Organizations should upgrade to one of the following fixed versions:

Stable branch: Upgrade to Parse Server 8.6.11
Alpha branch: Upgrade to Parse Server 9.5.0-alpha.14

For complete details on the vulnerability and remediation, refer to the GitHub Security Advisory GHSA-mf3j-86qx-cq5j.

Workarounds

Disable LiveQuery functionality entirely if not required for application functionality
Implement a Web Application Firewall (WAF) rule to inspect and block requests containing complex regex patterns
Deploy rate limiting on LiveQuery subscription endpoints to slow potential attack attempts
Consider placing Parse Server behind an API gateway that can validate and sanitize incoming queries

bash

# Example: Update Parse Server using npm
npm update parse-server@8.6.11

# Verify installed version
npm list parse-server