CVE-2026-31871: Parse Server SQL Injection Vulnerability in Increment Operation
Summary
CVE-2026-31871: Parse Server has a SQL Injection via dot-notation sub-key name in Increment operation on PostgreSQL. Affects parse across 2 version ranges.
< 8.6.31
>= 9.0.0, < 9.6.0
Fixed in 8.6.31 or 9.6.0, depending on the release line you run. How to fix ↓
Also tracked for
- parse-server · npm
The same CVE-2026-31871 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that enables developers to build applications without managing their own server infrastructure. It is designed to run on Node.js and offers features such as data storage, user authentication, and real-time notifications. The platform supports various databases, including PostgreSQL, which is where this vulnerability is particularly relevant.
Vulnerability Detail
The vulnerability arises from a SQL injection flaw in the PostgreSQL storage adapter of Parse Server, specifically when handling Increment operations on nested object fields using dot notation (e.g., stats.counter). Prior to versions 9.6.0 and 8.6.31, the sub-key name was directly interpolated into SQL string literals without proper escaping. This oversight allows an attacker to inject arbitrary SQL commands through crafted sub-key names, potentially leading to unauthorized data access or manipulation, bypassing security controls such as Class Level Permissions (CLPs) and Access Control Lists (ACLs). Only deployments using PostgreSQL are affected by this issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.6.318.6.31 -
>= 9.0.0, < 9.6.09.6.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate upgrading is not feasible, a temporary workaround is to sanitize input for the Increment operations by validating and escaping sub-key names before they are processed. However, this is not a substitute for applying the official patch.
Conclusion
CVE-2026-31871 represents a critical SQL injection vulnerability in Parse Server's handling of Increment operations with PostgreSQL. Users are strongly advised to upgrade to the patched versions to ensure their applications remain secure. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for parse →
FAQ
CVE-2026-31871 is a SQL injection vulnerability found in Parse Server's PostgreSQL storage adapter that affects Increment operations on nested object fields.
Only users of Parse Server who utilize PostgreSQL as their database are affected by this vulnerability.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is impacted by this vulnerability.
The risks include unauthorized access to data, potential data manipulation, and the ability to bypass security measures like CLPs and ACLs.
While upgrading is the best solution, you can implement input validation and sanitization as a temporary workaround to reduce the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
