CVE-2026-30972: Parse Server Rate Limit Bypass via Batch Request Endpoint
Summary
CVE-2026-30972: Parse Server has a rate limit bypass via batch request endpoint. Affects parse-server across 2 version ranges.
< 8.6.23
>= 9.0.0-alpha.1, < 9.5.2-alpha.10
Fixed in 8.6.23 or 9.5.2-alpha.10, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-30972 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that enables developers to build applications with a robust server-side infrastructure. It provides features such as data storage, user authentication, and push notifications. However, it has a vulnerability that allows attackers to bypass rate limiting through its batch request endpoint, potentially leading to abuse of server resources.
Vulnerability Detail
The vulnerability arises from the way Parse Server processes batch requests. The rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint processes sub-requests directly through the Promise router, bypassing the rate limiting checks. This allows an attacker to bundle multiple requests targeting a rate-limited endpoint into a single batch request, effectively circumventing the configured rate limit. Any deployment of Parse Server that relies on the built-in rate limiting feature is susceptible to this issue, which can lead to denial of service or resource exhaustion.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.238.6.23npm install parse-server@8.6.23 -
>= 9.0.0-alpha.1, < 9.5.2-alpha.109.5.2-alpha.10npm install parse-server@9.5.2-alpha.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, implement a reverse proxy or web application firewall (WAF) to enforce rate limiting before requests reach the Parse Server. This can help mitigate the risk of abuse until the package is updated.
Conclusion
In summary, CVE-2026-30972 is a significant vulnerability in Parse Server that allows for rate limit bypass through batch requests. It is crucial for developers to update their Parse Server installations to the patched versions to mitigate this risk. Additionally, implementing a reverse proxy or WAF can provide an interim solution.
See every vulnerability recorded for parse-server →
FAQ
The vulnerability allows attackers to bypass rate limiting by sending multiple requests in a single batch request.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which analyzes your package-lock.json for vulnerabilities.
The consequences include potential denial of service and resource exhaustion, as attackers can overwhelm the server with requests.
Yes, a permanent fix is available by updating to the specified patched versions of Parse Server.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just package-lock.json, providing real-time insights without requiring code access.
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
