Back Nvd.Nist

CVE-2026-30946 Detail - NVD

Nvd.Nist • March 11, 2026

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affected. This vulnerability is fixed in 9.5.2-alpha.2 and 8.6.15.

Denotes Vulnerable Software Are we missing a CPE here? Please let us know .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities Discovered in Parse Server Affecting User Security Two critical vulnerabilities have been identified in Parse Server, an open-source backend for Node.js. CVE-2026-30965 allows attackers to exfiltrate session tokens, potentially leading to account takeovers, affecting users with specific Class-Level Permissions. CVE-2026-30946 enables unauthenticated attackers to exhaust server resources through crafted queries, impacting all deployments using REST or GraphQL APIs. Both vulnerabilities were published on March 10, 2026, and have been addressed in recent updates. The affected versions are prior to 9.5.2-alpha.8 and 8.6.21 for CVE-2026-30965, and before 9.5.2-alpha.2 and 8.6.15 for CVE-2026-30946. Security professionals are urged to apply the patches to mitigate risks. 2 sources 58

Extracted Entities

Attack Types (1)

DDoS

CVEs (1)

CVE-2026-30946