QwikSec

Security Database

CVE

CWE

Training

CVE-2026-30946

Published: Mar 10, 2026

Modified: Mar 11, 2026

PUBLISHED

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affected. This vulnerability is fixed in 9.5.2-alpha.2 and 8.6.15.

Vendor	Product	Versions
parse-community	parse-server	affected `< 8.6.15` affected `>= 9.0.0 < 9.5.2-alpha.2`

Weaknesses (CWE)

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg

x_refsource_CONFIRM

https://github.com/parse-community/parse-server/releases/tag/8.6.15

x_refsource_MISC

https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.2

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.