The vulnerability is caused by Parse Server accepting an invalid regular expression in a LiveQuery subscription without validation. When a subscriber sends a malformed regex, the pattern is processed by the regex engine, causing the server process to terminate and all connected clients to lose service. This results in a denial‑of‑service impact for the affected Parse Server instance. The weakness is a lack of input validation (CWE‑248).

Affected systems are versions of Parse Server prior to 9.6.0‑alpha.19 and 8.6.43. All releases in the 9.6.x series up through alpha.18 and the 8.6.x series through 8.6.42 are vulnerable. The affected product is parse‑server, open‑source backend software that runs on Node.js. Only deployments using these vulnerable versions and that have LiveQuery enabled are at risk.

The CVSS score is 5.9, indicating a moderate severity. The EPSS score is below 1%, so the likelihood of exploitation is low, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote through the LiveQuery API – an attacker can craft a subscription request with an invalid regular expression and trigger the crash. Because the crash terminates the entire server process, it abruptly denies service to all current and future clients, making it a critical impact if not mitigated.