Parse Server is vulnerable to a Regular Expression Denial of Service that occurs when a client subscribes to LiveQuery with a crafted $regex pattern. The malicious input causes catastrophic backtracking in the JavaScript engine on the Node.js event loop, freezing the server and making it unresponsive to all clients. This vulnerability is a classic regular expression denial of service (CWE‑1333).

All deployments of Parse Server that enable LiveQuery and run a version prior to 8.6.11 or 9.5.0‑alpha.14 are affected. This includes every 8.6.x release up to and including 8.6.10, and every 9.5.0‑alpha.1 through alpha.13 release. Examples of included builds are those listed in the CPE data, such as 9.5.0‑alpha.1 to 9.5.0‑alpha.13.

The CVSS score of 8.2 indicates a high severity for availability impact. The EPSS score of less than 1% suggests that exploitation is currently unlikely but possible. The vulnerability is not listed in CISA’s KEV catalog. An attacker only needs the public application ID and JavaScript key to craft a subscription request, so the attack vector is remote and does not require privileged access. Successful exploitation blocks the entire Node.js event loop, effectively causing a denial of service for all connected clients.