PT-2026-24424 · Unknown · Parse Server

Mtrezza · Published 2026-03-10 · Updated 2026-03-12 · CVE-2026-30946

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.5.2-alpha.2 Parse Server versions prior to 8.6.15

Description Parse Server, an open-source backend deployable on Node.js infrastructures, is susceptible to resource exhaustion. An unauthenticated attacker can exploit the lack of complexity limits in the REST and GraphQL APIs to consume server resources such as CPU, memory, and database connections through crafted queries. All deployments utilizing the REST or GraphQL API are potentially affected.

Recommendations Update to Parse Server version 9.5.2-alpha.2 or later. Update to Parse Server version 8.6.15 or later.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

BIT-PARSE-2026-30946

CVE-2026-30946

GHSA-CMJ3-WX7H-FFVG

Affected Products

Parse Server

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30946.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cmj3-wx7h-ffvg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30946 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30946 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-30946 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.15 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.2 · Note
• https://twitter.com/CVEnew/status/2031504128329879920 · Twitter Post