7.5

CVE-2026-30972

Parse Server has a rate limit bypass via batch request endpoint

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batch) processes sub-requests internally by routing them directly through the Promise router, bypassing Express middleware including rate limiting. An attacker can bundle multiple requests targeting a rate-limited endpoint into a single batch request to circumvent the configured rate limit. Any Parse Server deployment that relies on the built-in rate limiting feature is affected. This vulnerability is fixed in 9.5.2-alpha.10 and 8.6.23.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Parseplatform ≫ Parse-server SwPlatform node.js Version < 8.6.23
Parseplatform ≫ Parse-server SwPlatform node.js Version >= 9.0.0 < 9.5.2
Parseplatform ≫ Parse-server Version 9.5.2 Update alpha1 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.5.2 Update alpha2 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.5.2 Update alpha3 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.5.2 Update alpha4 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.5.2 Update alpha5 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.5.2 Update alpha6 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.5.2 Update alpha7 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.5.2 Update alpha8 SwPlatform node.js
Parseplatform ≫ Parse-server Version 9.5.2 Update alpha9 SwPlatform node.js
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.258
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
security-advisories@github.com 6.9 0 0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE-799 Improper Control of Interaction Frequency

The product does not properly limit the number or frequency of interactions that it has with an actor, such as the number of incoming requests.

https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228
Patch
Vendor Advisory
https://github.com/parse-community/parse-server/releases/tag/8.6.23
Product
Release Notes
https://github.com/parse-community/parse-server/releases/tag/9.5.2-alpha.10
Product
Release Notes