CVE-2026-31871: Parse Server SQL Injection Vulnerability in Increment Operation
Summary
CVE-2026-31871: Impact A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). Affects parse-server across 2 version ranges.
< 8.6.31
>= 9.0.0-alpha.1, < 9.6.0-alpha.5
Fixed in 8.6.31 or 9.6.0-alpha.5, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-31871 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications without managing their own server infrastructure. It provides a REST API, real-time capabilities, and a flexible data model. However, a critical vulnerability has been identified in its PostgreSQL storage adapter, specifically affecting the Increment operation on nested object fields using dot notation.
Vulnerability Detail
A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). The sub-key name is interpolated directly into SQL string literals without escaping. An attacker who can send write requests to the Parse Server REST API can inject arbitrary SQL via a crafted sub-key name containing single quotes, potentially executing commands or reading data from the database, bypassing CLPs and ACLs. This vulnerability affects only PostgreSQL deployments and has a CVSS score of 9.3, indicating a critical severity level.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.318.6.31npm install parse-server@8.6.31 -
>= 9.0.0-alpha.1, < 9.6.0-alpha.59.6.0-alpha.5npm install parse-server@9.6.0-alpha.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The SQL injection vulnerability in Parse Server's PostgreSQL storage adapter poses a significant risk to applications using this framework. Immediate action is required to update to the patched versions to safeguard against potential attacks.
See every vulnerability recorded for parse-server →
FAQ
The vulnerability is a SQL injection issue that allows attackers to manipulate SQL queries through unescaped sub-key names in Increment operations.
Only users of Parse Server with PostgreSQL as their database are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring a signup.
While there is no workaround available, it is crucial to prioritize applying the patches as soon as possible to mitigate the risk.
The CVSS score of this vulnerability is 9.3, indicating a critical level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
