What is the CVSS score of CVE-2026-31840?

CVE-2026-31840 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of PostgreSQL are affected by CVE-2026-31840?

Parse Server deployments running version 9.6.0 or earlier are vulnerable to SQL injection attacks that could allow unauthorized database access and data exfiltration.. A patch is available.

How to fix or mitigate CVE-2026-31840?

Within 24 hours: Identify and inventory all Parse Server instances and their versions in your environment; isolate affected systems from production if possible and implement network-based access controls. Within 7 days: Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns; implement database activity monitoring and alerting; restrict database user permissions to least-privilege principles. Within 30 days: Upgrade to Parse Server version 9.6.1 or later once patches are released; conduct database audit for unauthorized access; review and strengthen input validation across all application endpoints.

PostgreSQL CVE-2026-31840

CRITICAL

SQL Injection (CWE-89)

2026-03-11 security-advisories@github.com

GHSA-qpr4-jrj4-6f27

SQLi PostgreSQL Node.js Parse Server Parseplatform

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 17:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0-alpha.2 and 8.6.28.