CVE-2026-32770
Parseplatform Parse-Server ≤ 8.6.43
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-32770 is a medium-severity Uncaught Exception (CWE-248) vulnerability in Parseplatform Parse-Server. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 43th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) and SC-24 (Fail in Known State) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-32770 is a denial-of-service vulnerability in Parse Server, an open source backend deployable on any Node.js-compatible infrastructure. Versions prior to 9.6.0-alpha.19 and 8.6.43 are affected, where a remote attacker can crash the server process by subscribing to a LiveQuery with an invalid regular expression pattern. The crash occurs when the invalid pattern reaches the regex engine during subscription matching, terminating the server and disrupting service for all connected clients. This issue is classified under CWE-248 (Uncaught Exception).
A remote, unauthenticated attacker can exploit this vulnerability over the network by sending a LiveQuery subscription request containing a malicious regex pattern, though it requires high attack complexity as indicated by the CVSS v3.1 base score of 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Successful exploitation triggers an unhandled exception in the regex engine, immediately crashing the server process and causing a denial of service that impacts all clients relying on the Parse Server instance.
The Parse Server security advisory and related pull requests detail mitigations in versions 9.6.0-alpha.19 and 8.6.43, which validate regular expression patterns at subscription time and reject invalid ones before storage. A defense-in-depth try-catch block was also added to prevent subscription matching errors from crashing the server. As a workaround, administrators can disable LiveQuery if it is not required. Relevant resources include the GitHub advisory at GHSA-827p-g5x5-h86c and pull requests #10197 and #10199.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12985
Vulnerability Data
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular…
more
expression pattern. The server process terminates when the invalid pattern reaches the regex engine during subscription matching, causing denial of service for all connected clients. The fix in 9.6.0-alpha.19 and 8.6.43 validates regular expression patterns at subscription time, rejecting invalid patterns before they are stored. Additionally, a defense-in-depth try-catch prevents any subscription matching error from crashing the server process. As a workaround, disable LiveQuery if it is not needed.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Security engineering principles include robust exception management to keep the system in a defined state.
Fail-in-known-state reduces the impact when an uncaught exception occurs by preserving a safe condition.
Error handling requirements force structured catching and response to exceptions instead of allowing them to propagate uncaught.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices explicitly require structured exception handling to prevent uncaught exceptions from reaching production.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect uncaught exceptions before production deployment.
Secure development lifecycle includes exception-handling standards that reduce uncaught exceptions.
Application security requirements typically mandate robust error and exception handling.
Secure architecture principles call for centralized, comprehensive exception management.
Secure coding standards directly require catching and handling exceptions to prevent crashes or leaks.