CVE-2026-30972 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batch) processes sub-requests internally by routing them directly through the Promise router, bypassing Express middleware including rate limiting. An attacker can bundle multiple requests targeting a rate-limited endpoint into a single batch request to circumvent the configured rate limit. Any Parse Server deployment that relies on the built-in rate limiting feature is affected. This vulnerability is fixed in 9.5.2-alpha.10 and 8.6.23.
A vulnerability in Parse Server prior to versions 9.5.2-alpha.10 and 8.6.23 allows for bypassing rate limits on certain endpoints. The issue arises because the batch request endpoint processes sub-requests through the Promise router, bypassing the Express middleware where rate limiting is applied. This allows an attacker to combine multiple requests targeting a rate-limited endpoint into a single batch request, effectively circumventing the rate limit. Any deployment of Parse Server that uses the built-in rate limiting feature is vulnerable.
Users can upgrade to Parse Server versions 9.5.2-alpha.10 or 8.6.23, where this vulnerability has been patched. For those using earlier versions, a reverse proxy or web application firewall (WAF) can be implemented to enforce rate limiting before requests reach the Parse Server.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/releases/tag/8.6.23 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.10 | [email protected] | ProductRelease Notes |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228 | [email protected] | PatchVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-799 | Improper Control of Interaction Frequency | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.23 >= 9.0.0, < 9.5.2 9.5.2 alpha1 9.5.2 alpha2 9.5.2 alpha3 9.5.2 alpha4 9.5.2 alpha5 9.5.2 alpha6 9.5.2 alpha7 9.5.2 alpha8 9.5.2 alpha9 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 11, 2026 | Initial Analysis | [email protected] |
| Mar 10, 2026 | New CVE Received | [email protected] |