CVE-2026-30946

UNKNOWN 0.0

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affected. This vulnerability is fixed in 9.5.2-alpha.2 and 8.6.15.

CWE	CWE-770
Vendor	parse-community
Product	parse-server
Published	Mar 10, 2026
Last Updated	Mar 11, 2026

Stay Ahead of the Next One

Get instant alerts for parse-community parse-server

Be the first to know when new unknown vulnerabilities affecting parse-community parse-server are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

parse-community / parse-server

< 8.6.15 >= 9.0.0 < 9.5.2-alpha.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg github.com: https://github.com/parse-community/parse-server/releases/tag/8.6.15 github.com: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.2