6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30835

CVE-2026-30835: Parse Server: Malformed `$regex` query leaks database error details in API response

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6, malformed $regex query parameter (e.g. [abc) causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals such as error messages, error codes, code names, cluster timestamps, and topology details. The vulnerability is exploitable by any client that can send query requests, depending on the deployment's permission configuration. This issue has been patched in versions 8.6.7 and 9.5.0-alpha.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30835

CVE-2026-30835:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.5.0-alpha.6	9.5.0-alpha.6
parse-server	npm	< 8.6.7	8.6.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the improper handling of database errors within the query execution layer of Parse Server. When a client provides a malformed query parameter, such as an invalid $regex, the underlying database driver throws a detailed error. The analysis of the patch commits reveals that at least one code path within the DatabaseController.find method was catching these raw error objects and wrapping them in a Parse.Error instance without sanitization. This Parse.Error object, now containing sensitive database error details, would then be sent in the API response, leading to an information disclosure vulnerability. The fix involves replacing the unsafe error wrapping with a call to a new createSanitizedError function. This function logs the detailed error for server administrators but returns a generic, sanitized error message to the client, effectively plugging the leak. The primary vulnerable function identified is DatabaseController.find, as it contains the flawed error handling logic that gets triggered during a malicious query.

Vulnerable functions

DatabaseController.find

src/Controllers/DatabaseController.js

The `find` method in `DatabaseController` has a code path for handling `_User` objects that involves loading associated roles. Within this logic, a `.catch` block was improperly handling errors from the database. Instead of sanitizing the error, it was wrapping the raw database error object within a `Parse.Error`. When a client sends a query with a malformed value, such as an invalid `$regex`, the database generates a detailed error object. This object was being passed to the client, leaking internal database information. The vulnerable function is the entry point for this logic and would appear in any runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.