Parse Server
CVE-2026-31856
CRITICAL
GHSA-q3vj-96h2-gwvg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted REST API write request
-
DeliveryTarget Increment operation on nested object field
-
ExploitInject SQL subquery in amount parameter
-
ExecutionExecute arbitrary SQL query
-
ImpactExfiltrate database contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Parse Server deployed with PostgreSQL storage adapter. Attacker must have network access to REST API write endpoints. No authentication required. MongoDB deployments are unaffected; only PostgreSQL adapter is vulnerable. |
| Impact | CVSS 9.8. |
| Exploit ScenarioDerived | SQL injection. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31.
Earlier versions of this analysis (1)
Another SQLi in Parse Server.
RemediationAI
Update.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-89.
Know when Parse Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
2DescriptionGitHub Advisory
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The amount value is interpolated directly into the SQL query without parameterization or type validation. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL subqueries to read any data from the database, bypassing CLPs and ACLs. MongoDB deployments are not affected. This vulnerability is fixed in 9.6.0-alpha.3 and 8.6.29.
Executive ViewAI
A critical SQL injection vulnerability in Parse Server's PostgreSQL adapter allows unauthenticated attackers to execute arbitrary SQL commands through Increment operations on nested fields, potentially compromising data confidentiality, integrity, and availability. Organizations using Parse Server in production with PostgreSQL backends face immediate risk of data breach and system compromise until remediation is completed.
Deploy Web Application Firewall (WAF) rules to detect and block Increment operations containing SQL injection patterns in nested field notation; implement database access controls and network segmentation to limit Parse Server's database privileges to read-only where possible; disable Increment operations on nested fields at the application level until patch is available; enable comprehensive SQL query logging and monitoring for anomalous database activity; restrict Parse Server network access to authorized applications only; consider temporarily disabling the entire Parse Server instance if business operations permit until official patch is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)GitHub Advisory
Related Vulnerabilities in Parse Server SQL Injection
View all 3More in Parse Server
View allParse Server is an open source http web server backend. Rated critical severity (CVSS 10.0), this vulnerability is remot
Unauthenticated query injection in Parse Server before 9.6.0-alpha.12/8.6.38. PoC available.
Parse Server has an incorrect authorization vulnerability enabling unauthorized data access across applications.
### Impact Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all
Parse Server has a CVSS 10.0 access control vulnerability enabling complete bypass of all data access restrictions.
parse-server is a Parse Server for Node.js / Express. Rated critical severity (CVSS 10.0), this vulnerability is remotel
Authentication bypass in Parse Server allows unauthenticated access to protected API endpoints. Parse Server is a popula
SQL injection in Parse Server before 9.6.0-alpha.5/8.6.31. Third Parse Server SQLi.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Rated critical s
Exploit-DB