CVE-2026-30946

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.5

CVSS v4.0

8.7

EPSS

0.56%

Published

Mar 10, 2026

Modified

Mar 11, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affected. This vulnerability is fixed in 9.5.2-alpha.2 and 8.6.15.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-770

Affected Products (3)

parseplatform · parse-server (up to 8.6.15)vulnerable

parseplatform · parse-server (up to 9.5.2)vulnerable

parseplatform · parse-servervulnerable

References (3)

https://github.com/parse-community/parse-server/releases/tag/8.6.15

Release NotesProduct

https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.2

Release NotesProduct

https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg

PatchVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs