CVE-2026-30925: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30925 is a Regular Expression Denial of Service (ReDoS) vulnerability in Parse Server's LiveQuery feature, classified under GHSA-mf3j-86qx-cq5j. A malicious client can subscribe to a LiveQuery with a crafted $regex pattern that causes catastrophic backtracking, blocking the Node.js event loop and rendering the entire Parse Server unresponsive. Affected versions include all Parse Server releases prior to 8.6.11 and versions 9.0.0 through 9.5.0-alpha.13 (for Node.js). The vulnerability was published on March 7, 2026, and patched the same day. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 8.2 (High) (Github Advisory, Parse Server Advisory).

The root cause is CWE-1333 (Inefficient Regular Expression Complexity), also mapped to CAPEC-492 (Regular Expression Exponential Blowup). Parse Server's LiveQuery subscription matching evaluates $regex query operators directly in JavaScript on the Node.js event loop, unlike normal REST and GraphQL queries where regex evaluation is handled by the database engine. An attacker can craft a pathological regex pattern (e.g., one with nested quantifiers) that triggers catastrophic backtracking, consuming all available CPU cycles on the event loop thread and blocking all other processing. Exploitation requires only the application ID and JavaScript key, both of which are typically embedded in client-side applications and considered public (Github Advisory, Parse Server Advisory).

Successful exploitation results in a complete denial of service for the entire Parse Server instance — all connected clients lose service simultaneously, as the blocked Node.js event loop prevents any request from being processed. There is no impact on confidentiality or integrity; the attack is purely an availability attack. REST and GraphQL endpoints are not directly affected by the regex evaluation, but since the event loop is shared, all server functionality becomes unresponsive until the server is restarted or the malicious subscription is terminated (Github Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (Github Advisory). No threat actor attribution has been reported. The EPSS score is approximately 0.013% (0.021% per GitHub Advisory), placing it in the 6th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the low exploitation probability, the low barrier to attack — requiring only publicly available credentials — makes it a notable risk for any Parse Server deployment with LiveQuery enabled.

1. Reconnaissance: Identify a Parse Server deployment with LiveQuery enabled. Obtain the application ID and JavaScript key from the client-side application (e.g., by inspecting a mobile app or web app's source code or network traffic, as these credentials are typically public).
2. Establish LiveQuery connection: Connect to the Parse Server's LiveQuery WebSocket endpoint (typically wss://<server>/1/events or similar) using the Parse SDK or a raw WebSocket client.
3. Craft malicious subscription: Subscribe to a LiveQuery on a target class using a $regex query parameter containing a catastrophically backtracking pattern. Example payload structure:

{
  "op": "subscribe",
  "requestId": 1,
  "query": {
    "className": "MyClass",
    "where": {
      "field": { "$regex": "^(a+)+$" }
    }
  }
}

4. Trigger backtracking: The server evaluates the regex against incoming objects on the Node.js event loop. The crafted pattern causes exponential backtracking, consuming all CPU cycles.
5. Achieve denial of service: The Node.js event loop becomes fully blocked, making the entire Parse Server unresponsive to all clients until the server process is restarted (Parse Server Advisory).

• Network: Unexpected or repeated WebSocket connections to the Parse Server LiveQuery endpoint from unknown or suspicious IP addresses; sustained high-volume subscription requests containing $regex operators.
• Process/System: Node.js process CPU usage spiking to 100% and remaining elevated; server becoming unresponsive to all incoming requests while the Node.js process is still running.
• Logs: Parse Server logs showing LiveQuery subscription events with $regex fields from unexpected clients; application-level timeout errors or connection refusals logged for all clients simultaneously.
• Application Behavior: All Parse Server clients (REST, GraphQL, LiveQuery) losing connectivity simultaneously without a server crash or restart, indicating event loop blockage rather than a process failure (Parse Server Advisory).

Upgrade Parse Server to version 8.6.11 (for the 8.x branch) or 9.5.0-alpha.14 (for the 9.x branch), both released on March 7, 2026. The fix runs regex evaluation in an isolated VM context with a configurable timeout via the new liveQuery.regexTimeout option (default: 100ms); regexes exceeding the timeout are treated as non-matching. As a workaround for deployments that cannot immediately patch, use the beforeSubscribe Cloud Code hook to reject any LiveQuery subscription containing a $regex operator (note: this also blocks startsWith, endsWith, and contains query methods). Additionally, consider implementing network-level access controls to restrict access to Parse Server LiveQuery endpoints (Parse Server Advisory, Release 8.6.11, Release 9.5.0-alpha.14).

The vulnerability was reported by TinkAnet and coordinated by mtrezza (a Parse Server maintainer), with the advisory and patches released simultaneously on March 7, 2026, demonstrating responsible disclosure practices (Parse Server Advisory). No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability tracking and aggregation sites.