What is the CVSS score of CVE-2026-31872?

CVE-2026-31872 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2026-31872?

Parse Server deployments are vulnerable to a HIGH severity authentication bypass that allows attackers to extract protected field values through query manipulation, potentially exposing sensitive…. A patch is available.

How to fix or mitigate CVE-2026-31872?

Within 24 hours: Inventory all Parse Server instances and versions in production; assess whether protected fields contain sensitive data (credentials, PII, financial info). Within 7 days: Implement network segmentation to restrict Parse Server access to trusted applications only; deploy WAF rules to block dot-notation patterns in query parameters (e.g., filter requests containing '.' in WHERE and sort clauses); disable public API access if not business-critical. Within 30 days: Monitor vendor announcements for patch availability; evaluate migration to alternative backends or upgrade to patched versions immediately upon release.

Node.js CVE-2026-31872

HIGH

Improper Access Control (CWE-284)

2026-03-11 security-advisories@github.com

GHSA-r2m8-pxm9-9c4g

Node.js PostgreSQL Authentication Bypass Parse Server

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 11, 2026 - 18:16 nvd

HIGH 7.5

DescriptionGitHub Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values. This affects both MongoDB and PostgreSQL deployments. This vulnerability is fixed in 9.6.0-alpha.6 and 8.6.32.

AnalysisAI

Parse Server versions prior to 9.6.0-alpha.6 and 8.6.32 allow attackers to bypass class-level permission restrictions on protected fields by using dot-notation in query and sort parameters, enabling enumeration of sensitive field values through binary oracle attacks. This affects both MongoDB and PostgreSQL deployments and requires no authentication or user interaction. No patch is currently available for affected versions.

Technical ContextAI

This vulnerability (CWE-284: Improper Access Control) exists in the query WHERE clauses and sort component. Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker can use dot-notation to query or sort by sub-fields of a protected field, enabling a binary oracle attack to enumerate protected field values. This affects both MongoDB and PostgreSQL deployments. This vulnerability is fi