The vulnerability occurs when a malformed $regex query, such as an incomplete pattern, is processed by Parse Server. The database returns a detailed error object that is not sanitized before being included in the API response. As a result, sensitive database internals—including error messages, codes, cluster timestamps, and topology details—are exposed to the attacker. The flaw is categorized as a CWE‑209 weakness in Error Handling and Logging.

Parse Server products from the parse-community, specifically all releases prior to version 8.6.7 and the 9.5.0‑alpha.6 branch, are affected. Deployments running these older releases on any Node.js‑capable infrastructure are vulnerable. No other vendors or product variants are currently listed as impacted.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be any client that can submit query requests to the Parse Server endpoint; exploitation depends on the deployment’s permission configuration, so the risk is higher in environments with permissive client access.