VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Mar 7, 2026· Updated Jun 17, 2026

CVE-2026-30854

CVE-2026-30854

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0-alpha.10.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
parse-servernpm
>= 9.3.1-alpha.3, < 9.5.0-alpha.109.5.0-alpha.10

Affected products

15
  • Parseplatform/Parse Server12 versions
    cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*+ 11 more
    • cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*range: >=9.4.0,<9.5.0
    • cpe:2.3:a:parseplatform:parse-server:9.3.1:alpha3:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.3.1:alpha4:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha1:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha2:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha3:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha4:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha5:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha6:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha7:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha8:*:*:*:node.js:*:*
    • cpe:2.3:a:parseplatform:parse-server:9.5.0:alpha9:*:*:*:node.js:*:*
  • osv-coords2 versions
    pkg:bitnami/parsepkg:npm/parse-server
    >= 9.3.1, < 9.5.0+ 1 more
    • (no CPE)range: >= 9.3.1, < 9.5.0
    • (no CPE)range: >= 9.3.1-alpha.3, < 9.5.0-alpha.10
  • Parse Community/Parse Serverv5
    Range: >= 9.3.1-alpha.3, < 9.5.0-alpha.10

Patches

Vulnerability mechanics

References

3

News mentions

0

No linked articles in our index yet.