CVE-2026-32594 json
Parse Server GraphQL WebSocket endpoint bypasses security middleware
published 2026-03-13 7 mo ago modified 2026-09-25 45 d ago also BIT-parse-2026-32594 , EUVD-2026-12097 , GHSA-p2x3-8689-cwpg
- cvss
- 7.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 34%
- public exploits
- 0
- none known
Summary
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection control, and query complexity limits. An attacker can connect to the WebSocket endpoint and execute GraphQL operations without providing a valid application or API key, access the GraphQL schema via introspection even when public introspection is disabled, and send arbitrarily complex queries that bypass configured complexity limits. This vulnerability is fixed in 8.6.40 and 9.6.0-alpha.14.
Patch / fix
- npm parse-server 8.6.40, 9.6.0-alpha.14
- bitnami parse 8.6.40, 9.6.0
- parseplatform parse-server 8.6.40, 9.6.0-alpha.14
- parseplatform parse_server 8.6.40, 9.6.0-alpha.14
- github.com/parse-community/parse-server@21330d1 commit
- github.com/parse-community/parse-server@3ffba75 commit
- github.com/parse-community/parse-server#10189 pull request
- github.com/parse-community/parse-server#10190 pull request
- github.com/parse-community/parse-server/security/advisories/GHSA-p2x3… advisory
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| OSV | 3.1 | 7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | parse-server | >=9.0.0, <9.6.0-alpha.14 <8.6.40 |
9.6.0-alpha.14 8.6.40 |
| bitnami | parse | <8.6.40 >=9.0.0, <9.6.0 |
8.6.40 9.6.0 |
Affected products
- parse-community parse-server
Classification
- Weakness
-
- CWE-306 Missing Authentication for Critical Functionality
References
-
github.com
/parse-community/parse-server/pull/10189
web, issue-tracking, patch
-
github.com
/parse-community/parse-server/pull/10190
web, issue-tracking, patch
-
github.com
/parse-community/parse-server/security/advisories/GHSA-p2x3-8689-cwpg
web, mitigation, patch, vendor-advisory, advisory
-
github.com
/parse-community/parse-server/commit/21330d146c68b57a930a58b8a8cd9fbf09436cf3
web
-
github.com
/parse-community/parse-server/commit/3ffba757bfc836bd034e1369f4f64304e110e375
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-32594
advisory, web
-
github.com
/parse-community/parse-server
package
Sources
- CVE List CVE-2026-32594
- GitHub Advisory GHSA-p2x3-8689-cwpg
- NVD CVE-2026-32594
- OSV BIT-parse-2026-32594
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.