Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL

緊急 9.8CVE-2026-31856 · BIT-parse-2026-31856 · GHSA-q3vj-96h2-gwvg · 11/03/2026 公開 · 17/06/2026 更新

要点

CVE-2026-31856 は parse-server (parseplatform), parse-server に影響する深刻度「緊急」 (CVSS 9.8) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.44%（全脆弱性の 38.1% より高い）。
対処：9.6.0, 8.6.29, 9.6.0-alpha.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
parse-server parseplatform	`= 9.6.0≥ 9.0.0, < 9.6.0< 8.6.29`	`9.6.08.6.29`
parse-server npm	`≥ 9.0.0-alpha.1, < 9.6.0-alpha.3< 8.6.29`	`9.6.0-alpha.38.6.29`

概要

Impact

A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The amount value is interpolated directly into the SQL query without parameterization or type validation. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL subqueries to read any data from the database, bypassing CLPs and ACLs.

MongoDB deployments are not affected.

Patches

The fix adds type validation to reject non-number values and parameterizes the value in the SQL query instead of interpolating it.

Workarounds

There is no known workaround.

References

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q3vj-96h2-gwvg
Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.3
Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.29

NVD の説明

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The amount value is interpolated directly into the SQL query without parameterization or type validation. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL subqueries to read any data from the database, bypassing CLPs and ACLs. MongoDB deployments are not affected. This vulnerability is fixed in 9.6.0-alpha.3 and 8.6.29.