CVE-2026-30972

The record

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batch) processes sub-requests internally by routing them directly through the Promise router, bypassing Express middleware including rate limiting. An attacker can bundle multiple requests targeting a rate-limited endpoint into a single batch request to circumvent the configured rate limit. Any Parse Server deployment that relies on the built-in rate limiting feature is affected. This vulnerability is fixed in 9.5.2-alpha.10 and 8.6.23.

Affected packages

Related vulnerabilities

• GHSA-775h-3xrc-c228 Parse Server has a rate limit bypass via batch request endpoint Same vulnerability
• GHSA-97pr-9hgg-3p8r parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access… Also affects parse-server
• GHSA-wmwx-jr2p-4j4r parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL Also affects parse-server
• GHSA-7wqv-xjf3-x35v parse-server: Stored XSS via trailing-dot filename bypassing file upload extension… Also affects parse-server
• GHSA-p84r-h6rx-f2xr parse-server: Server option routeAllowList is bypassable through batch sub-requests Also affects parse-server
• GHSA-cgxm-vr2f-6fj8 parse-server: Denial of service via exponential-time processing of deeply nested query… Also affects parse-server
• CVE-2026-53726 Parse Server is an open source backend that can be deployed to any infrastructure that… Also affects parse-server
• CVE-2026-53724 Parse Server is an open source backend that can be deployed to any infrastructure that… Also affects parse-server