CVE-2026-30835

EPSS 0.34%
Veröffentlicht 06.03.2026 20:28:27
Zuletzt bearbeitet 11.03.2026 13:08:11
Erkennungen
Login

Parse Server: Malformed `$regex` query leaks database error details in API response

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6,  malformed $regex query parameter (e.g. [abc) causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals such as error messages, error codes, code names, cluster timestamps, and topology details. The vulnerability is exploitable by any client that can send query requests, depending on the deployment's permission configuration. This issue has been patched in versions 8.6.7 and 9.5.0-alpha.6.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 6

NVD 7 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Parseplatform ≫ Parse-server SwPlatform node.js Version < 8.6.7

Parseplatform ≫ Parse-server SwPlatform node.js Version >= 9.0.0 < 9.5.0

Parseplatform ≫ Parse-server Version 9.5.0 Update alpha1 SwPlatform node.js

Parseplatform ≫ Parse-server Version 9.5.0 Update alpha2 SwPlatform node.js

Parseplatform ≫ Parse-server Version 9.5.0 Update alpha3 SwPlatform node.js

Parseplatform ≫ Parse-server Version 9.5.0 Update alpha4 SwPlatform node.js

Parseplatform ≫ Parse-server Version 9.5.0 Update alpha5 SwPlatform node.js

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.34%	0.251

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5.3	3.9	1.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
security-advisories@github.com	6.9	0	0	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X