[parse-server] parse-server: Malformed `$regex` query leaks database error details in API response

**[parse-server] parse-server: Malformed `$regex` query leaks database error details in API response**

Impact A malformed $regex query parameter (e.g. [abc) causes the database to return a structured error object that is passed unsanitized through the API response. This leaks database internals such as error messages, error codes, code names, cluster timestamps, and topology details. The vulnerability is exploitable by any client that can send query requests, depending on the deployment's permission configuration. Patches The fix sanitizes database error objects so that only a generic "An internal server error occurred" message is returned to clients, while the detailed error is logged server-side...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.