ZeroDay Findings
Sign inSign up

Findings

CVE-2026-30946

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

Published Mar 10, 2026 · updated Jun 17, 2026 · parseplatform parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affected. This vulnerability is fixed in 9.5.2-alpha.2 and 8.6.15.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 10, 2026 · NIST NVD

    Detected

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affec

  2. Jun 17, 2026 · NIST NVD

    Updated

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affec

Affected

  • cpe parseplatform/parse-serverversion unspecified
  • cpe parseplatform/parse-server9.5.2

Sources

  • CVE.orgVulnerability recordCVE-2026-30946

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-30946

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack

    nvd.nist.gov

References