CVE-2026-32770: Parse Server LiveQuery DoS Vulnerability

CVE-2026-32770 Overview

Parse Server, an open source backend that can be deployed to any infrastructure running Node.js, contains a Denial of Service vulnerability in its LiveQuery subscription handling. A remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. When the invalid pattern reaches the regex engine during subscription matching, the server process terminates, causing denial of service for all connected clients.

Critical Impact

Remote attackers can cause complete service disruption by crashing the Parse Server process, affecting all connected clients and applications dependent on the backend service.

Affected Products

• Parse Server versions prior to 8.6.43
• Parse Server versions 9.6.0-alpha1 through 9.6.0-alpha18
• All Parse Server deployments with LiveQuery enabled running vulnerable versions

Discovery Timeline

• March 18, 2026 - CVE-2026-32770 published to NVD
• March 19, 2026 - Last updated in NVD database

Technical Details for CVE-2026-32770

Vulnerability Analysis

This vulnerability is classified under CWE-248 (Uncaught Exception), indicating that the Parse Server fails to properly handle exceptions when processing malformed regular expression patterns in LiveQuery subscriptions. The flaw exists in the subscription matching logic where user-supplied regex patterns are passed directly to the JavaScript regex engine without validation.

When a client subscribes to a LiveQuery, they can specify query conditions including regular expression patterns for field matching. If an attacker provides a syntactically invalid regex pattern, the JavaScript regex engine throws an exception during the subscription matching phase. Because this exception is not caught, it propagates up and terminates the Node.js process entirely.

The vulnerability requires no authentication and can be exploited remotely over the network. While it does not compromise data confidentiality or integrity, the availability impact is significant as it affects all users connected to the Parse Server instance.

Root Cause

The root cause is twofold: insufficient input validation of regular expression patterns at subscription time, and the absence of defensive exception handling around the subscription matching logic. User-supplied regex patterns were trusted and used directly without first validating that they constitute valid regular expressions.

Attack Vector

An attacker can exploit this vulnerability by establishing a WebSocket connection to the LiveQuery server and sending a subscription request containing a malformed regular expression pattern. When the server attempts to compile and use this regex during subscription matching operations, the invalid pattern causes an uncaught exception that crashes the server process.

The attack is straightforward to execute as it only requires the ability to connect to the LiveQuery WebSocket endpoint. Since the vulnerability crashes the entire server process, a single malicious subscription can deny service to all legitimate users of the Parse Server instance.

Detection Methods for CVE-2026-32770

Indicators of Compromise

• Unexpected Parse Server process terminations or restarts
• Error logs containing regex-related exceptions or syntax errors
• Unusual WebSocket subscription activity from unknown or suspicious client IPs
• Repeated server crashes correlated with LiveQuery subscription events

Detection Strategies

• Monitor Node.js process health and implement alerting on unexpected terminations
• Analyze WebSocket traffic to LiveQuery endpoints for malformed subscription payloads
• Review Parse Server logs for regex compilation errors or uncaught exception traces
• Implement connection rate limiting and anomaly detection on LiveQuery subscriptions

Monitoring Recommendations

• Configure process monitoring to detect and alert on Parse Server crashes
• Enable verbose logging for LiveQuery subscription events to capture suspicious patterns
• Set up network monitoring to identify unusual connection patterns to WebSocket endpoints
• Deploy application performance monitoring (APM) to track server stability metrics

How to Mitigate CVE-2026-32770

Immediate Actions Required

• Upgrade Parse Server to version 8.6.43 or 9.6.0-alpha.19 or later immediately
• If immediate patching is not possible, disable LiveQuery functionality as a temporary workaround
• Review access controls to limit who can establish LiveQuery subscriptions
• Implement network-level protections to restrict access to LiveQuery endpoints

Patch Information

The Parse Server maintainers have released fixes in versions 8.6.43 and 9.6.0-alpha.19. The patches implement two protective measures: validation of regular expression patterns at subscription time to reject invalid patterns before they are stored, and a defense-in-depth try-catch mechanism that prevents any subscription matching error from crashing the server process.

For detailed information about the fix, refer to the GitHub Security Advisory GHSA-827p-g5x5-h86c. The specific code changes can be reviewed in Pull Request #10197 and Pull Request #10199.

Workarounds

• Disable LiveQuery entirely if it is not required for your application functionality
• Implement a reverse proxy or API gateway to filter and validate subscription requests before they reach Parse Server
• Deploy Parse Server behind a web application firewall (WAF) with rules to detect malformed regex patterns
• Use network segmentation to restrict LiveQuery access to trusted clients only

# Disable LiveQuery in Parse Server configuration
# In your Parse Server initialization, remove or comment out LiveQuery configuration:
# liveQuery: {
#   classNames: ['Posts', 'Comments']
# }
# 
# Alternatively, upgrade to patched version:
npm update parse-server@8.6.43
# or for alpha channel:
npm update parse-server@9.6.0-alpha.19