CVE-2026-30946
published 2026-03-10CVE-2026-30946: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated…
PriorityP348high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.56%
42.5th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affected. This vulnerability is fixed in 9.5.2-alpha.2 and 8.6.15.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 8.6.15 | 8.6.15 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 0 < 8.6.15 | 8.6.15 |
| parse-community | parse-server | >= 9.0.0 < 9.5.2-alpha.2 | 9.5.2-alpha.2 |
| parseplatform | parse-server | < 8.6.15 | 8.6.15 |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | >= 9.0.0 < 9.5.2 | 9.5.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
ghsa·2026-03-11
CVE-2026-30946 [HIGH] CWE-770 Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
### Impact
An unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs.
All Parse Server deployments using the REST or GraphQL API are affected.
### Patches
The vulnerability is fixed by introducing configurable request complexity limits via the `requestComplexity` server option with the following keys:
- `subqueryDepth`: Maximum nesting depth for `$inQuery`, `$notInQuery`, `$select`, `$dontSelect`
- `includeDepth`: Maximum depth of dot-separated `include` paths
- `includeCount`: Maximum number of `include` fields per query
- `graphQLDepth`: Maximum depth
OSV
Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
osv·2026-03-11
CVE-2026-30946 [HIGH] Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
### Impact
An unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs.
All Parse Server deployments using the REST or GraphQL API are affected.
### Patches
The vulnerability is fixed by introducing configurable request complexity limits via the `requestComplexity` server option with the following keys:
- `subqueryDepth`: Maximum nesting depth for `$inQuery`, `$notInQuery`, `$select`, `$dontSelect`
- `includeDepth`: Maximum depth of dot-separated `include` paths
- `includeCount`: Maximum number of `include` fields per query
- `graphQLDepth`: Maximum depth
No detection rules found.
No public exploits indexed.
2026-03-10
Published