What is the CVSS score of CVE-2026-32594?

CVE-2026-32594 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Node.js are affected by CVE-2026-32594?

Organizations using Parse Server face moderate risk from CVE-2026-32594, a missing authentication vulnerability rated CVSS 7.3.. A patch is available.

How to fix or mitigate CVE-2026-32594?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Audit authentication configurations and rotate any potentially compromised credentials.

Node.js CVE-2026-32594

EUVD-2026-12097 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-13 GitHub_M

GHSA-p2x3-8689-cwpg

Authentication Bypass Node.js Parse Server

7.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 13, 2026 - 21:01 euvd

EUVD-2026-12097

Analysis Generated

Mar 13, 2026 - 21:01 vuln.today

CVE Published

Mar 13, 2026 - 19:56 nvd

HIGH 7.3

DescriptionGitHub Advisory

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection control, and query complexity limits. An attacker can connect to the WebSocket endpoint and execute GraphQL operations without providing a valid application or API key, access the GraphQL schema via introspection even when public introspection is disabled, and send arbitrarily complex queries that bypass configured complexity limits. This vulnerability is fixed in 8.6.40 and 9.6.0-alpha.14.

AnalysisAI

Parse Server versions prior to 8.6.40 and 9.6.0-alpha.14 contain an authentication bypass vulnerability in their GraphQL WebSocket subscription endpoint that circumvents Express middleware security controls. An unauthenticated attacker can connect directly to the WebSocket endpoint to execute arbitrary GraphQL operations, perform schema introspection despite disabled public introspection, and send complex queries that bypass rate limiting and complexity validation. This is a network-accessible vulnerability requiring no authentication that exposes sensitive schema information and enables potential denial-of-service attacks.

Technical ContextAI

Parse Server is a Node.js-based open-source backend-as-a-service platform that provides GraphQL query capabilities through both HTTP and WebSocket transports. The vulnerability stems from CWE-306 (Missing Authentication for Critical Function), where the GraphQL WebSocket subscription endpoint fails to invoke the Express middleware authentication chain that is applied to standard HTTP GraphQL endpoints. The WebSocket upgrade process bypasses middleware that enforces API key validation, introspection policy controls, and query complexity limits. This is a protocol-level bypass where the WebSocket handler creates a separate code path that does not inherit the security context of the Express application. The affected CPE is cpe:2.3:a:parse_project:parse_server, impacting the Node.js backend deployment across all infrastructure types capable of running Node.js.

RemediationAI

Immediately upgrade Parse Server to version 8.6.40 or later for the 8.x branch, or to version 9.6.0-alpha.14 or later for the 9.x branch. Download the patched release from the official Parse Server GitHub repository or NPM registry. As an interim workaround before patching, restrict network access to the WebSocket endpoint (typically at the /graphql path with WebSocket protocol) to trusted clients only using a reverse proxy or firewall rules. Implement IP-based whitelisting at the network boundary and consider disabling GraphQL subscriptions entirely if not required for your application. Additionally, audit logs to identify any suspicious WebSocket connections or introspection queries that may have occurred during the vulnerability window. Apply the patches at your earliest maintenance window as the authentication bypass can be exploited without triggering application-level alerts.