{"cve":"CVE-2026-32770","nvd":{"published":"2026-03-18T22:16:25.343","modified":"2026-06-17T10:36:21.317","status":"Analyzed","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process terminates when the invalid pattern reaches the regex engine during subscription matching, causing denial of service for all connected clients. The fix in 9.6.0-alpha.19 and 8.6.43 validates regular expression patterns at subscription time, rejecting invalid patterns before they are stored. Additionally, a defense-in-depth try-catch prevents any subscription matching error from crashing the server process. As a workaround, disable LiveQuery if it is not needed.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},"cwes":["CWE-248"],"references":["https://github.com/parse-community/parse-server/pull/10197","https://github.com/parse-community/parse-server/pull/10199","https://github.com/parse-community/parse-server/security/advisories/GHSA-827p-g5x5-h86c"],"products":["parseplatform:parse-server"],"source":"nvd","synced_at":"2026-10-19T22:26:19.218427112+00:00"},"epss":{"cve":"CVE-2026-32770","score":0.00571,"percentile":0.47279,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-827p-g5x5-h86c","url":"https://osv.dev/vulnerability/GHSA-827p-g5x5-h86c","summary":"Parse Server LiveQuery subscription with invalid regular expression crashes server","modified":"2026-03-20T12:26:07.201571Z","packages":[{"ecosystem":"npm","name":"parse-server","purl":"pkg:npm/parse-server","ranges":[">=9.0.0 <9.6.0-alpha.19"],"fixed":["9.6.0-alpha.19"]},{"ecosystem":"npm","name":"parse-server","purl":"pkg:npm/parse-server","ranges":["<8.6.43"],"fixed":["8.6.43"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}