CVE-2026-30962

npm/parse-server CVE-2026-30962: high, EPSS 0.42%

Parse Server has a protected fields bypass via logical query operators

Action: Upgrade parse-server to 8.6.19 or later.

npm i parse-server@9.5.2-alpha.6

npm i parse-server@8.6.19

Affected

Fixed versions

Sources

• osv: GHSA-72hp-qff8-4pvv
• https://github.com/parse-community/parse-server/security/advisories/GHSA-72hp-qff8-4pvv
• https://nvd.nist.gov/vuln/detail/CVE-2026-30962
• https://github.com/parse-community/parse-server
• https://github.com/parse-community/parse-server/releases/tag/8.6.19
• https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.6

CVE-2026-30962 · published 2026-03-11T00:19:57Z · modified 2026-03-14T03:41:13.140891Z · JSON