CVE-2026-30946CWE-770

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

High · published March 10, 2026

CVSS v4.0
8.7
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack of complexity limits in the REST and GraphQL APIs. All Parse Server deployments using the REST or GraphQL API are affected. This vulnerability is fixed in 9.5.2-alpha.2 and 8.6.15.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00661 · 51.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-03-10T20:14Z
EPSS history
Timeline
  • 10 MAR 20:14Z
    Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
    cvelistv5