CVE-2026-30946: Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
Impact
An unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs.
All Parse Server deployments using the REST or GraphQL API are affected.
Patches
The vulnerability is fixed by introducing configurable request complexity limits via the requestComplexity server option with the following keys:
- subqueryDepth: Maximum nesting depth for $inQuery, $notInQuery, $select, $dontSelect - includeDepth: Maximum depth of dot-separated include paths - includeCount: Maximum number of include fields per query - graphQLDepth: Maximum depth of GraphQL field selections - graphQLFields: Maximum number of field selections in a GraphQL query
If the server options are not set their default values apply to fix the vulnerability. Requests using master key or maintenance key bypass these limits. Set any property to -1 to disable that specific limit.
Workarounds
There is no known workaround.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.2 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.15
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affected. This vulnerability is fixed in 9.5.2-alpha.2 and 8.6.15.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30946?
CVE-2026-30946 has a high severity rating due to its potential to allow denial-of-service attacks against Parse Server.
How do I fix CVE-2026-30946?
To mitigate CVE-2026-30946, upgrade to Parse Server version 9.5.2-alpha.2 or 8.6.15 or later.
Who is affected by CVE-2026-30946?
CVE-2026-30946 affects all deployments of Parse Server prior to versions 9.5.2-alpha.2 and 8.6.15.
What type of attack does CVE-2026-30946 allow?
CVE-2026-30946 allows unauthenticated attackers to potentially exhaust server resources through unbounded query complexity.
Is authentication required to exploit CVE-2026-30946?
No, CVE-2026-30946 can be exploited by unauthenticated attackers.