CVE-2026-31856: Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
Impact
A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The amount value is interpolated directly into the SQL query without parameterization or type validation. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL subqueries to read any data from the database, bypassing CLPs and ACLs.
MongoDB deployments are not affected.
Patches
The fix adds type validation to reject non-number values and parameterizes the value in the SQL query instead of interpolating it.
Workarounds
There is no known workaround.
References
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q3vj-96h2-gwvg - Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.3 - Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.29
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The amount value is interpolated directly into the SQL query without parameterization or type validation. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL subqueries to read any data from the database, bypassing CLPs and ACLs. MongoDB deployments are not affected. This vulnerability is fixed in 9.6.0-alpha.3 and 8.6.29.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31856?
CVE-2026-31856 is classified as a high severity SQL injection vulnerability.
How do I fix CVE-2026-31856?
To fix CVE-2026-31856, upgrade to parse-server version 8.6.29 or version 9.6.0-alpha.3 or later.
What is the impact of CVE-2026-31856?
CVE-2026-31856 allows attackers to execute arbitrary SQL queries through improperly handled data in Increment operations.
Which software is affected by CVE-2026-31856?
CVE-2026-31856 affects versions of parse-server prior to 8.6.29 and between 9.0.0-alpha.1 and 9.6.0-alpha.3.
Can CVE-2026-31856 be exploited remotely?
Yes, CVE-2026-31856 can be exploited remotely if the affected application is exposed to the internet.