5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32770

CVE-2026-32770: Parse Server: LiveQuery subscription with invalid regular expression crashes server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process terminates when the invalid pattern reaches the regex engine during subscription matching, causing denial of service for all connected clients. The fix in 9.6.0-alpha.19 and 8.6.43 validates regular expression patterns at subscription time, rejecting invalid patterns before they are stored. Additionally, a defense-in-depth try-catch prevents any subscription matching error from crashing the server process. As a workaround, disable LiveQuery if it is not needed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32770

CVE-2026-32770:

5.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.6.0-alpha.19	9.6.0-alpha.19
parse-server	npm	< 8.6.43	8.6.43

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because Parse Server's LiveQuery feature did not properly handle invalid regular expressions supplied by a client during subscription. The root cause is twofold: first, the server accepted and stored subscriptions containing malformed regex patterns without validation. Second, when a database event triggered a subscription match, the code that executed the regex would throw an uncaught exception if the pattern was invalid, crashing the entire server process.

The analysis of the patch commits reveals the key functions involved. The vulnerability is initiated in the 'subscribe' event handler within ParseLiveQueryServer._onConnect, which formerly lacked validation. The patch introduces a new function, _validateQueryConstraints, to reject invalid queries at subscription time.

The actual crash occurred within the safeRegexTest function in QueryTools.js. This function would re-throw exceptions from the RegExp constructor, leading to a process termination. The patch modifies safeRegexTest to catch these exceptions and return false instead of crashing.

As a further safeguard, the calls to ParseLiveQueryServer._matchesSubscription (which triggers the regex matching) within the _onAfterSave and _onAfterDelete event handlers were wrapped in try-catch blocks. This ensures that even if an invalid regex somehow made it into the system, it would not cause a denial of service. Therefore, these three functions are the critical points in the execution flow of this vulnerability.

Vulnerable functions

ParseLiveQueryServer._onConnect

src/LiveQuery/ParseLiveQueryServer.ts

This function, specifically the 'subscribe' event handler within it, is responsible for processing new LiveQuery subscription requests from clients. Prior to the patch, it did not validate regular expression patterns within the query constraints. This allowed a malicious subscription with an invalid regex to be accepted and stored by the server, setting up the conditions for a later crash.

safeRegexTest

src/LiveQuery/QueryTools.js

This function is responsible for executing a regular expression test. Before the patch, it would attempt to create a new RegExp object from the provided pattern. If the pattern was invalid, this would throw an exception. The function would catch timeout errors but re-throw any other exception, which would propagate up the stack and crash the Node.js process, causing a denial of service.

ParseLiveQueryServer._matchesSubscription

src/LiveQuery/ParseLiveQueryServer.ts

This function is called when database objects are updated or deleted to determine if they match any active LiveQuery subscriptions. It indirectly calls `safeRegexTest`. When `safeRegexTest` threw an exception due to an invalid regex from a stored subscription, the exception would propagate through `_matchesSubscription` and crash the server. The patch adds a try-catch block around the calls to this function as a defense-in-depth measure, preventing a single faulty subscription from bringing down the entire server.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.