CVE-2026-50008: parse-server Bypass of routeAllowList in Batch Requests
Summary
CVE-2026-50008: parse-server: Server option routeAllowList is bypassable through batch sub-requests. Affects parse-server versions >= 9.8.0, < 9.9.1-alpha.3. Fixed in 9.9.1-alpha.3. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-50008 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust REST API. It provides features such as data storage, user authentication, and real-time notifications. The routeAllowList option is designed to restrict access to specific API routes, enhancing security by controlling which endpoints can be accessed by external clients.
Vulnerability Detail
The vulnerability arises from a flaw in the routeAllowList server option, which is intended to restrict external client access to a predefined list of REST API routes. The enforcement of this restriction is only applied to the outer HTTP request URL. Consequently, when a request is made to the /batch endpoint, the server processes each sub-request without re-evaluating the allow-list check. This allows an external attacker to exploit the batch functionality to access any REST API route that is not explicitly included in the allow-list, potentially leading to unauthorized access to sensitive data or operations. Although authentication and other authorization controls remain in effect, the bypass of the route firewall poses a significant security risk.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.9.1-alpha.3
This is the first release that contains the fix.
npm install parse-server@9.9.1-alpha.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade immediately, you can mitigate the issue by explicitly including every inner route you want to allow via batch in the allow-list. For example, configure your routeAllowList as follows: routeAllowList: ['batch', 'classes/Public.*', 'functions/allowedFunction']. This will make those inner routes accessible as direct REST requests as well, which is broader than the post-patch behavior but eliminates the bypass.
Conclusion
The vulnerability CVE-2026-50008 in parse-server allows for the bypass of the routeAllowList through batch sub-requests, potentially exposing sensitive API routes to unauthorized access. It is crucial to update to the patched version or implement the recommended workaround to mitigate this risk.
See every vulnerability recorded for parse-server →
FAQ
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
The vulnerability affects parse-server versions starting from 9.8.0 up to, but not including, 9.9.1-alpha.3.
The routeAllowList option restricts external client access to a specified list of REST API routes, enhancing security by controlling which endpoints can be accessed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application by using the Vulert playground at Vulert Scanner without any signup.
If upgrading is not possible, implement the suggested workaround by explicitly including all inner routes you want to allow in the routeAllowList.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
