CVE-2026-30941: Parse Server NoSQL Injection Vulnerability in Password Reset and Email Verification
Summary
CVE-2026-30941: Parse Server has a NoSQL injection via token type in password reset and email verification endpoints. Affects parse-server across 2 version ranges.
< 8.6.14
>= 9.0.0, < 9.5.2-alpha.1
Fixed in 8.6.14 or 9.5.2-alpha.1, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-30941 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that enables developers to build applications quickly by providing a robust set of features, including user authentication, data storage, and real-time notifications. It is widely used in mobile and web applications. However, it has been found to be vulnerable to a NoSQL injection attack, particularly affecting its password reset and email verification functionalities.
Vulnerability Detail
The vulnerability arises from a lack of input type validation in the password reset and email verification endpoints. An unauthenticated attacker can exploit this by injecting MongoDB query operators through the 'token' field, allowing them to extract sensitive information such as password reset and email verification tokens. This could lead to unauthorized access to user accounts, as attackers can verify email addresses without needing access to the user's inbox.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.148.6.14npm install parse-server@8.6.14 -
>= 9.0.0, < 9.5.2-alpha.19.5.2-alpha.1npm install parse-server@9.5.2-alpha.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no known workarounds for this vulnerability. It is recommended to apply the patch as soon as possible to mitigate the risk.
Conclusion
The NoSQL injection vulnerability in Parse Server poses a significant risk to applications using this platform for user authentication and email verification. It is crucial to update to the patched versions to safeguard against potential attacks. Regular monitoring using tools like Vulert can help maintain the security of your application.
See every vulnerability recorded for parse-server →
FAQ
A NoSQL injection vulnerability allows attackers to manipulate database queries by injecting malicious code, potentially leading to unauthorized data access or manipulation.
If you are using Parse Server with MongoDB and have enabled email verification or password reset features, your deployment may be vulnerable. You can check your package-lock.json file using Vulert to see if you are affected.
Exploitation of this vulnerability could allow attackers to verify user email addresses and gain unauthorized access to user accounts, compromising user data and security.
Yes, you can use Vulert to monitor your application for open-source vulnerabilities in real-time. It analyzes your package-lock.json file to alert you of any issues.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
