npm/parse-server CVE-2026-30854: medium 5.3, EPSS 0.29%
Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
Action: Upgrade parse-server to 9.5.0-alpha.10 or later.
npm i parse-server@9.5.0-alpha.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.3.1-alpha.3 | 9.5.0-alpha.10 | - |
Fixed versions
| 9.5.0-alpha.10 |
Sources
- osv: GHSA-q5q9-2rhp-33qw
- nvd: CVE-2026-30854
- https://github.com/parse-community/parse-server/security/advisories/GHSA-q5q9-2rhp-33qw
- https://github.com/parse-community/parse-server
CVE-2026-30854 · published · modified · JSON