NewApp Monitoring is liveSign up free
AgentbeamBeta
Open-source package vulnerability · npm

CVE-2026-31840: Parse Server: SQL injection via dot-notation field name in PostgreSQL

criticalCVSS 4.0 9.3GHSA-qpr4-jrj4-6f27

Impact An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters. This vulnerability only affects deployments using a PostgreSQL database.

Published Mar 10, 2026 · Updated Mar 11, 2026

Affected packages

parse-server

Ecosystem
npm
Affected
>= 9.0.0, < 9.6.0-alpha.2
Fixed in
9.6.0-alpha.2
Check
npm ls parse-server

parse-server

Ecosystem
npm
Affected
< 8.6.28
Fixed in
8.6.28
Check
npm ls parse-server

Advisory details

From the GitHub Advisory Database (CC BY 4.0).

Impact

An attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through an improper escaping of sub-field values in dot-notation queries. The vulnerability may also affect queries that use dot-notation field names with the distinct and where query parameters.

This vulnerability only affects deployments using a PostgreSQL database.

Patches

The fix escapes characters in dot-notation sub-field values that could allow a SQL breakout.

Workarounds

There is no known workaround.

References

  • GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-qpr4-jrj4-6f27
  • Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.6.0-alpha.2
  • Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.28

Credited to offset, mtrezza.

References

How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology

More npm vulnerabilities

All npm entries