In short
- CVE-2026-31840 is a CRITICAL (CVSS 9.8) vulnerability affecting parse-server (parseplatform), parse-server.
- Chance of exploitation in the next 30 days (EPSS): 0.43%, higher than 37.6% of all vulnerabilities.
- Fix: update to 9.6.0, 8.6.28, 9.6.0-alpha.2 or later.
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.28
| 9.6.08.6.28
|
| parse-server npm | ≥ 9.0.0, < 9.6.0-alpha.2< 8.6.28
| 9.6.0-alpha.28.6.28
|
Description
Impact
An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters.
This vulnerability only affects deployments using a PostgreSQL database.
Patches
The fix escapes characters in dot-notation sub-field values that could allow a SQL breakout.
Workarounds
There is no known workaround.
References
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database. This vulnerability is fixed in 9.6.0-alpha.2 and 8.6.28.
More vulnerabilities in parse-server
See all →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free