What is the CVSS score of CVE-2026-31856?

CVE-2026-31856 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-31856?

A critical SQL injection vulnerability in Parse Server's PostgreSQL adapter allows unauthenticated attackers to execute arbitrary SQL commands through Increment operations on nested fields,…. A patch is available.

How to fix or mitigate CVE-2026-31856?

Within 24 hours: Isolate affected Parse Server instances from production traffic or disable Increment operations on nested object fields; inventory all Parse Server deployments using PostgreSQL; notify security and development teams. Within 7 days: Implement WAF rules to block malicious Increment payloads with dot notation; apply network segmentation to restrict database access; conduct forensic logs review for exploitation attempts. Within 30 days: Coordinate with Parse Server maintainers for patch availability; evaluate alternative backend solutions or migrate to patched version immediately upon release; complete full security assessment of affected systems.

Node.js CVE-2026-31856

CRITICAL

SQL Injection (CWE-89)

2026-03-11 security-advisories@github.com

GHSA-q3vj-96h2-gwvg

Node.js PostgreSQL SQLi Parse Server

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 18:16 nvd

CRITICAL 9.8

DescriptionGitHub Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The amount value is interpolated directly into the SQL query without parameterization or type validation. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL subqueries to read any data from the database, bypassing CLPs and ACLs. MongoDB deployments are not affected. This vulnerability is fixed in 9.6.0-alpha.3 and 8.6.29.