npm/parse-server CVE-2026-30925: high 7.5, EPSS 0.47%
Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
Action: Upgrade parse-server to 8.6.11 or later.
npm i parse-server@9.5.0-alpha.14npm i parse-server@8.6.11Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.0.0-alpha.1 | 9.5.0-alpha.14 | - |
| 0 | 8.6.11 | - |
Fixed versions
| 9.5.0-alpha.14 | 8.6.11 |
Sources
- osv: GHSA-mf3j-86qx-cq5j
- nvd: CVE-2026-30925
- https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j
- https://github.com/parse-community/parse-server
- https://github.com/parse-community/parse-server/releases/tag/8.6.11
- https://github.com/parse-community/parse-server/releases/tag/9.5.0-alpha.14
CVE-2026-30925 · published · modified · JSON