CVE-2026-30835: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30835 is an information disclosure vulnerability in Parse Server, an open-source Node.js backend platform, where a malformed $regex query parameter causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals including error messages, error codes, code names, cluster timestamps, and topology details. Affected versions include all Parse Server releases prior to 8.6.7 (8.x branch) and versions 9.0.0 through 9.5.0-alpha.5 (9.x branch). The vulnerability was published on March 5–6, 2026, with patches released simultaneously. It carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 6.9 (Medium) (Github Advisory).

The root cause is classified as CWE-209 (Generation of Error Message Containing Sensitive Information). When a client submits a malformed regular expression — such as [abc — as a $regex query parameter, the underlying database engine fails to parse it and returns a structured error object. Parse Server's query execution layer does not sanitize this error object before including it in the API response, exposing internal database details to the requesting client. No authentication or special privileges are required to trigger the error; exploitability depends solely on whether the deployment allows unauthenticated or low-privilege clients to issue query requests (Github Advisory).

Successful exploitation results in a confidentiality breach, exposing database internals such as error messages, error codes, code names, cluster timestamps, and database topology details to any client able to send query requests. There is no direct integrity or availability impact. However, the leaked infrastructure and topology information could enable an attacker to conduct more targeted follow-on attacks against the database cluster or underlying infrastructure, increasing the overall risk beyond the immediate disclosure (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.014% (3rd percentile), indicating a low near-term probability of exploitation. The attack requires no authentication, no user interaction, and no special configuration, making it trivially exploitable against any internet-facing Parse Server deployment that permits query access (Github Advisory).

1. Reconnaissance: Identify internet-facing Parse Server instances (e.g., via Shodan, Censys, or application fingerprinting) running versions prior to 8.6.7 or between 9.0.0 and 9.5.0-alpha.5.
2. Craft malformed query: Construct an HTTP GET or POST request to the Parse Server query API endpoint (e.g., /parse/classes/<ClassName>) with a malformed $regex parameter, such as {"where":{"fieldName":{"$regex":"[abc"}}}.
3. Send the request: Submit the request to the target Parse Server API, optionally including an application ID header (X-Parse-Application-Id) if required by the deployment.
4. Collect leaked data: Inspect the API response body for the unsanitized database error object, which may contain error messages, error codes, code names, cluster timestamps, and topology details.
5. Leverage intelligence: Use the extracted infrastructure details (e.g., database cluster topology, version strings) to plan further targeted attacks against the backend database or related systems (Github Advisory).

• Network: Repeated HTTP requests to Parse Server query endpoints (e.g., /parse/classes/*) containing malformed $regex values such as [abc or other syntactically invalid regular expressions; unusual volume of query requests from a single IP or user agent.
• Logs: Parse Server access logs showing query requests with $regex parameters that trigger database errors; server-side error log entries containing structured database error objects (error codes, cluster timestamps, topology details) associated with regex parsing failures.
• Application: API responses containing fields such as codeName, errorLabels, topologyVersion, or similar database-internal fields that should not appear in normal query responses.

The parse-community has released patched versions that sanitize database error objects, returning only a generic "An internal server error occurred" message to clients while logging detailed errors server-side. Users should upgrade to Parse Server 8.6.7 (8.x branch) or Parse Server 9.5.0-alpha.6 (9.x branch) immediately. There is no configuration-based workaround — the error leakage occurs at the query execution layer and cannot be mitigated without upgrading. As an additional defense-in-depth measure, administrators should enforce strict access controls on query permissions to limit which clients can send query requests to the Parse Server API (Github Advisory, Release 8.6.7, Release 9.5.0-alpha.6).

The vulnerability was coordinated and disclosed by maintainer mtrezza and reported by researcher fancymalware via the parse-community GitHub security advisory process. The advisory was published at a Moderate severity rating, reflecting the limited but real risk of infrastructure information leakage. No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (Github Advisory).