What is the CVSS score of CVE-2026-32770?

CVE-2026-32770 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-32770?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Vendor patch is available.

CVE-2026-32770

MEDIUM

Uncaught Exception (CWE-248)

2026-03-17 https://github.com/parse-community/parse-server

GHSA-827p-g5x5-h86c

Denial Of Service

5.9

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 17, 2026 - 20:30 vuln.today

Patch released

Mar 17, 2026 - 20:30 nvd

Patch available

CVE Published

Mar 17, 2026 - 18:37 nvd

MEDIUM 5.9

DescriptionGitHub Advisory

Impact

A remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process terminates when the invalid pattern reaches the regex engine during subscription matching, causing denial of service for all connected clients.

Patches

The fix validates regular expression patterns at subscription time, rejecting invalid patterns before they are stored. Additionally, a defense-in-depth try-catch prevents any subscription matching error from crashing the server process.

Workarounds

Disable LiveQuery if it is not needed.

AnalysisAI

Parse Server contains a denial-of-service vulnerability in its LiveQuery feature where remote attackers can crash the server by subscribing with an invalid regular expression pattern. The vulnerability affects npm package parse-server across versions and allows unauthenticated network-based attacks with high attack complexity, resulting in complete service disruption for all connected clients. A patch is available from the vendor, and the attack does not require user interaction or special privileges.

Technical ContextAI

The vulnerability exists in Parse Server's LiveQuery subscription matching mechanism, which processes regular expression patterns supplied by clients during subscription requests. When an invalid regex pattern is passed to the regex engine during subscription evaluation, the unhandled exception propagates and terminates the entire server process. This is classified under CWE-248 (Uncaught Exception), a root cause involving insufficient error handling around regex compilation and pattern matching operations. The affected product is the npm package parse-server, which implements a real-time query subscription system. The vulnerability surfaces when pattern validation occurs too late in the lifecycle—specifically during matching rather than at subscription time—allowing malformed input to reach dangerous code paths.

RemediationAI

Apply the vendor patch immediately by upgrading Parse Server to a patched version that includes fixes from pull requests #10197 and #10199 (see https://github.com/parse-community/parse-server for version details and release notes). The patches implement two complementary controls: regex pattern validation at subscription time to reject invalid patterns before they are stored, and a defense-in-depth try-catch wrapper around subscription matching logic to prevent any regex engine errors from crashing the process. As an interim workaround if immediate patching is not feasible, disable the LiveQuery feature entirely if it is not actively used in your deployment. Additionally, implement network segmentation to restrict access to Parse Server endpoints to trusted clients and monitor error logs for regex-related exceptions that may indicate exploitation attempts.