Skip to main content

Parse Server CVE-2026-30972

HIGH
Improper Control of Interaction Frequency (CWE-799)
2026-03-10 security-advisories@github.com GHSA-775h-3xrc-c228
Node.js Parse Server Parseplatform
7.5
CVSS 3.1 · GitHub Advisory
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send batch request to /batch endpoint
  2. Exploit
    Bundle rate-limited requests internally
  3. Execution
    Bypass Express rate limiting middleware
  4. Impact
    Trigger denial of service on target endpoint

Vulnerability Assessment

Weakness
CWE
CWE-799
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Interaction frequency control
Exploitation Conditions

Parse Server versions prior to 9.5.2-alpha.10 and 8.6.23 with rate limiting middleware configured. Attacker must have network access to the /batch endpoint, which processes sub-requests through internal Promise router that bypasses Express middleware rate limits.
Impact

CVSS 7.5 (HIGH). Attack vector: Network. Complexity: Low. Privileges required: None. User interaction: None.
Exploit ScenarioDerived

An attacker could exploit this vulnerability to compromise the affected system.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Parse Server versions prior to 9.5.2-alpha.10 and 8.6.23 allow remote attackers to bypass rate limiting protections by submitting multiple requests within a single batch request, since batch processing routes requests internally and circumvents Express middleware controls. Deployments relying on built-in rate limiting are vulnerable to abuse and denial of service attacks. A patch is available in the specified versions.

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:55 CVSS 7.5

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. [CVSS 7.5 HIGH]

RemediationAI

A vendor patch is available — apply it immediately. Fixed in version 9.5.2. Restrict network access to the affected service where possible.

Affected Packages

npm parse-server fix: 8.6.23, 9.5.2-alpha.10

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Classified as CWE-799 (Improper Control of Interaction Frequency). Affects Parse-Server. Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batch) processes sub-requests internally by routing them directly through the Promise router, bypassing Express middleware including rate limiting. An attacker can bundle multiple requests targeting a rate-limited endpoint into a single batch r

Know when Parse Server gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch released
Mar 11, 2026 - 18:42 nvd
Patch available
CVE Published
Mar 10, 2026 - 21:16 nvd
HIGH 7.5

DescriptionGitHub Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batch) processes sub-requests internally by routing them directly through the Promise router, bypassing Express middleware including rate limiting. An attacker can bundle multiple requests targeting a rate-limited endpoint into a single batch request to circumvent the configured rate limit. Any Parse Server deployment that relies on the built-in rate limiting feature is affected. This vulnerability is fixed in 9.5.2-alpha.10 and 8.6.23.

Executive ViewAI

Why It Matters

A HIGH severity vulnerability (CVE-2026-30972) affects Parse Server deployments, potentially allowing attackers to compromise backend services that support customer-facing applications. Organizations running Parse Server on Node.js infrastructure face immediate risk of unauthorized access or data breach if systems remain unpatched.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 88% exploitable
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

38
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +38
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Affected Products (CPE)GitHub Advisory

cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha1:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha2:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha3:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha4:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha5:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha6:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha7:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha8:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.2:alpha9:*:*:*:node.js:*:*

Related Vulnerabilities in Parse Server Multiple Security Flaws

View all 10
CVE-2026-31800 CRITICAL
9.1
CVE-2026-30967 HIGH
8.8
CVE-2026-30965 CRITICAL POC
9.1
CVE-2026-30962 MEDIUM
6.5
CVE-2026-30947 HIGH
7.5
CVE-2026-30946 HIGH
7.5
CVE-2026-30949 HIGH
8.8
CVE-2026-30966 CRITICAL
10.0
CVE-2026-31828 HIGH
8.8

More in Parse Server

View all
CVE-2022-24760 CRITICAL POC
10.0 Mar 12

Parse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
CVE-2026-32248 CRITICAL POC
9.8 Mar 12

Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available.
CVE-2026-32242 HIGH POC
7.4 Mar 12

### Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all

CVE-2024-27298 CRITICAL
10.0 Mar 01

parse-server is a Parse Server for Node.js / Express. Rated critical severity (CVSS 10.0), this vulnerability is remotel
CVE-2026-30863 CRITICAL
9.8 Mar 07

Authentication bypass in Parse Server allows unauthenticated access to protected API endpoints. Parse Server is a popula
CVE-2026-31840 CRITICAL
9.8 Mar 11

SQL injection in Parse Server before 9.6.0-alpha.2/8.6.28.
CVE-2026-31871 CRITICAL
9.8 Mar 11

SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi.
CVE-2026-31856 CRITICAL
9.8 Mar 11

SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31.
CVE-2023-36475 CRITICAL
9.8 Jun 28

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
CVE-2022-41878 CRITICAL
9.8 Nov 10

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s

Same weakness CWE-799 – Improper Control of Interaction Frequency

View all
CVE-2024-47065 MEDIUM POC
6.5
CVE-2024-57603 MEDIUM POC
6.3
CVE-2023-2758 MEDIUM POC
5.3
CVE-2026-100603 HIGH
8.7
CVE-2024-45788 HIGH
8.7
CVE-2024-35246 HIGH
8.7
CVE-2024-32943 HIGH
8.7
CVE-2025-29998 HIGH
8.2

References

Advisories & patches
PATCH https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228 ADVISORY https://vuldb.com/?id.350229 REF https://github.com/parse-community/parse-server/releases/tag/8.6.23 REF https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.10

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy