CVE-2026-30938

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30938
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request payload. This is caused by a logic bug that stops scanning sibling keys after encountering the first nested value. Any custom requestKeywordDenylist entries configured by the developer are equally by-passable using the same technique. All Parse Server deployments are affected. The requestKeywordDenylist is enabled by default. This vulnerability is fixed in 8.6.12 and 9.5.1-alpha.1. Use a Cloud Code beforeSave trigger to validate incoming data for prohibited keywords across all classes.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/parse-community/parse-server/releases/tag/8.6.12 Product Release Notes
https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.1 Product Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-q342-9w2p-57fp Mitigation Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
History

11 Mar 2026, 19:53

Type Values Removed Values Added
References () https://github.com/parse-community/parse-server/releases/tag/8.6.12 - () https://github.com/parse-community/parse-server/releases/tag/8.6.12 - Product, Release Notes
References () https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.1 - () https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.1 - Product, Release Notes
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-q342-9w2p-57fp - () https://github.com/parse-community/parse-server/security/advisories/GHSA-q342-9w2p-57fp - Mitigation, Patch, Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3
CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
First Time Parseplatform
Parseplatform parse-server

11 Mar 2026, 13:53

Type Values Removed Values Added
Summary
  • (es) Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de las versiones 8.6.12 y 9.5.1-alpha.1, el control de seguridad requestKeywordDenylist puede ser eludido al colocar cualquier objeto o array anidado antes de una palabra clave prohibida en la carga útil de la solicitud. Esto es causado por un error de lógica que detiene el escaneo de claves hermanas después de encontrar el primer valor anidado. Cualquier entrada personalizada de requestKeywordDenylist configurada por el desarrollador es igualmente eludible utilizando la misma técnica. Todas las implementaciones de Parse Server están afectadas. El requestKeywordDenylist está habilitado por defecto. Esta vulnerabilidad está corregida en las versiones 8.6.12 y 9.5.1-alpha.1. Utilice un disparador beforeSave de Cloud Code para validar los datos entrantes en busca de palabras clave prohibidas en todas las clases.

10 Mar 2026, 18:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:18

Updated : 2026-03-11 19:53

NVD link : CVE-2026-30938

Mitre link : CVE-2026-30938

CVE.ORG link : CVE-2026-30938

JSON object : View

Products Affected

parseplatform

  • parse-server
CWE
CWE-693

Protection Mechanism Failure