CVE-2026-30925

{"id": "CVE-2026-30925", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-30925", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T14:08:58.113708Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "parse-community", "product": "parse-server", "versions": [{"status": "affected", "version": ">= 9.0.0 < 9.5.0-alpha.14"}, {"status": "affected", "version": "< 8.6.11"}]}]}], "published": "2026-03-10T17:40:16.313", "references": [{"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.11", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.14", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j", "tags": ["Mitigation", "Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.0-alpha.14 and 8.6.11, a malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop. This makes the entire Parse Server unresponsive, affecting all clients. Any Parse Server deployment with LiveQuery enabled is affected. The attacker only needs the application ID and JavaScript key, both of which are public in client-side apps. This only affects LiveQuery subscription matching, which evaluates regex in JavaScript on the Node.js event loop. Normal REST and GraphQL queries are not affected because their regex is evaluated by the database engine. This vulnerability is fixed in 9.5.0-alpha.14 and 8.6.11."}, {"lang": "es", "value": "Parse Server es un backend de c\u00f3digo abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de 9.5.0-alpha.14 y 8.6.11, un cliente malicioso puede suscribirse a una LiveQuery con un patr\u00f3n $regex manipulado que causa un retroceso catastr\u00f3fico, bloqueando el bucle de eventos de Node.js. Esto hace que todo el Parse Server no responda, afectando a todos los clientes. Cualquier despliegue de Parse Server con LiveQuery habilitado se ve afectado. El atacante solo necesita el ID de aplicaci\u00f3n y la clave de JavaScript, ambos son p\u00fablicos en las aplicaciones del lado del cliente. Esto solo afecta la coincidencia de suscripci\u00f3n de LiveQuery, que eval\u00faa expresiones regulares en JavaScript en el bucle de eventos de Node.js. Las consultas REST y GraphQL normales no se ven afectadas porque sus expresiones regulares son evaluadas por el motor de la base de datos. Esta vulnerabilidad est\u00e1 corregida en 9.5.0-alpha.14 y 8.6.11."}], "lastModified": "2026-06-17T10:33:09.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "34762D4D-4428-4142-9C28-3C38B316E35B", "versionEndExcluding": "8.6.11"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "77A07A2F-C8ED-4D78-A9C0-66AB42F69F38", "versionEndExcluding": "9.5.0", "versionStartIncluding": "9.0.0"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha1:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3E9F95CF-EEE1-42FC-904E-321F05E3DE4E"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha10:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "18465CD3-DB00-4A7C-99D9-8B841829EEE4"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha11:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "17BBDC30-3BA1-4608-B525-3E4753682FDE"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha12:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "384713D3-BD33-4021-AE0B-E752A2CC814E"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha13:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "518F4432-3E3D-4A97-973C-536D68D47928"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha2:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "5C02D6F0-5A3A-45F5-8A74-F75A8CCAE7DE"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha3:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "103C9745-031B-4822-A19C-A61375FBB1AD"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha4:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "8D67029D-C1BD-4D46-A84F-C52B4D364268"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha5:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3B10930D-B416-4D9A-BA26-F0AD22BFAE28"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha6:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "72794836-5CFB-4928-BB22-D7DE813809B4"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha7:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "FA2C4C1E-3AE6-48E0-8B59-80554AE85BB0"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha8:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "40C8E499-E5C6-48DD-AE36-B73B2B6ADA67"}, {"criteria": "cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha9:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E92B2675-5D49-404B-BEC1-7037D6C1ACD5"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}