CVE-2026-33538: Parse Server Denial of Service via Unconfigured Authentication Providers
Summary
CVE-2026-33538: Parse Server: Denial of Service via unindexed database query for unconfigured auth providers. Affects parse-server across 2 version ranges.
< 8.6.58
>= 9.0.0, < 9.6.0-alpha.52
Fixed in 8.6.58 or 9.6.0-alpha.52, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-33538 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust server-side infrastructure. It provides features such as data storage, user authentication, and real-time notifications. However, it is vulnerable to a Denial of Service (DoS) attack when unconfigured authentication providers are used, which can lead to resource exhaustion and application downtime.
Vulnerability Detail
The vulnerability arises from the way Parse Server handles authentication requests. An unauthenticated attacker can exploit this by sending requests with arbitrary, unconfigured provider names. Each request triggers a database query for the unconfigured provider, resulting in a full collection scan on the user database due to the absence of an index. This can be parallelized, allowing attackers to saturate database resources, leading to a Denial of Service.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.588.6.58npm install parse-server@8.6.58 -
>= 9.0.0, < 9.6.0-alpha.529.6.0-alpha.52npm install parse-server@9.6.0-alpha.52
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds other than upgrading to the patched versions mentioned above.
Conclusion
The vulnerability CVE-2026-33538 in Parse Server poses a significant risk of Denial of Service due to unconfigured authentication providers. It is crucial for users to upgrade to the patched versions to safeguard their applications against potential attacks.
See every vulnerability recorded for parse-server →
FAQ
An attacker can cause a Denial of Service by sending authentication requests with unconfigured provider names, leading to resource exhaustion.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Versions 0.x to 9.5.x of Parse Server are affected by this vulnerability.
The CVSS score of this vulnerability is 8.7, indicating a high severity level.
Unfortunately, there are no known workarounds other than upgrading to the patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
