CVE-2026-30972: Parse Server Rate Limit Bypass Vulnerability
Summary
CVE-2026-30972: Parse Server has a rate limit bypass via batch request endpoint. Affects parse across 2 version ranges.
< 8.6.23
>= 9.0.0, < 9.5.2
Fixed in 8.6.23 or 9.5.2, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-30972 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Parse Server is an open-source backend platform that allows developers to build applications on any infrastructure that supports Node.js. It provides a robust set of features including data storage, user authentication, and push notifications. However, prior to versions 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting mechanism was not effectively enforced for batch requests, making it susceptible to abuse.
Vulnerability Detail
The vulnerability arises from the way Parse Server processes batch requests at the /batch endpoint. Instead of applying the rate limiting middleware at the Express layer, sub-requests are routed directly through the Promise router, bypassing the rate limiting checks. This allows an attacker to bundle multiple requests into a single batch request, effectively circumventing the configured rate limits. The ramifications include potential denial of service or abuse of the server resources, as attackers can overwhelm the server with excessive requests.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.6.238.6.23 -
>= 9.0.0, < 9.5.29.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement additional checks in your application logic to limit the number of requests processed in a single batch. This can be done by validating the size of incoming batch requests before processing them.
Conclusion
CVE-2026-30972 represents a significant vulnerability in Parse Server that allows for rate limit bypass through batch requests. It is crucial for users of affected versions to update to the patched releases to ensure the security and stability of their applications.
See every vulnerability recorded for parse →
FAQ
CVE-2026-30972 is a vulnerability in Parse Server that allows attackers to bypass rate limiting by sending multiple requests in a single batch request.
Versions prior to 9.5.2-alpha.10 and 8.6.23 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to denial of service or resource exhaustion, as attackers can exploit it to send excessive requests to the server.
If immediate updates are not possible, consider implementing additional request validation in your application to limit the number of requests processed in a single batch.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
