CVE-2026-30946

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30946
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affected. This vulnerability is fixed in 9.5.2-alpha.2 and 8.6.15.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/parse-community/parse-server/releases/tag/8.6.15 Release Notes Product
https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.2 Release Notes Product
https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha1:*:*:*:node.js:*:*
History

11 Mar 2026, 17:16

Type Values Removed Values Added
References () https://github.com/parse-community/parse-server/releases/tag/8.6.15 - () https://github.com/parse-community/parse-server/releases/tag/8.6.15 - Release Notes, Product
References () https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.2 - () https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.2 - Release Notes, Product
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg - () https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg - Patch, Vendor Advisory
CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha1:*:*:*:node.js:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
First Time Parseplatform
Parseplatform parse-server

11 Mar 2026, 13:52

Type Values Removed Values Added
Summary
  • (es) Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de 9.5.2-alpha.2 y 8.6.15, un atacante no autenticado puede agotar los recursos de Parse Server (CPU, memoria, conexiones de base de datos) a través de consultas manipuladas que explotan la falta de límites de complejidad en las API REST y GraphQL. Todas las implementaciones de Parse Server que utilizan la API REST o GraphQL están afectadas. Esta vulnerabilidad está corregida en 9.5.2-alpha.2 y 8.6.15.

10 Mar 2026, 21:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 21:16

Updated : 2026-03-11 17:16

NVD link : CVE-2026-30946

Mitre link : CVE-2026-30946

CVE.ORG link : CVE-2026-30946

JSON object : View

Products Affected

parseplatform

  • parse-server
CWE
CWE-770

Allocation of Resources Without Limits or Throttling