CVE-2026-30835: parse-server: Malformed `$regex` query leaks database error details in API response
A malformed $regex query parameter (e.g. [abc) causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals such as error messages, error codes, code names, cluster timestamps, and topology details. The vulnerability is exploitable by any client that can send query requests, depending on the deployment’s permission configuration.
References
- github.com/advisories/GHSA-9cp7-3q5w-j92g
- github.com/parse-community/parse-server
- github.com/parse-community/parse-server/releases/tag/8.6.7
- github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.6
- github.com/parse-community/parse-server/security/advisories/GHSA-9cp7-3q5w-j92g
- nvd.nist.gov/vuln/detail/CVE-2026-30835
Code Behaviors & Features
Detect and mitigate CVE-2026-30835 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →