CVE-2026-30938

Received Received - Intake

Logic Bug Allows requestKeywordDenylist Bypass in Parse Server

Publication date: 2026-03-10

Last updated on: 2026-03-11

Assigner: GitHub, Inc.

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request payload. This is caused by a logic bug that stops scanning sibling keys after encountering the first nested value. Any custom requestKeywordDenylist entries configured by the developer are equally by-passable using the same technique. All Parse Server deployments are affected. The requestKeywordDenylist is enabled by default. This vulnerability is fixed in 8.6.12 and 9.5.1-alpha.1. Use a Cloud Code beforeSave trigger to validate incoming data for prohibited keywords across all classes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-03-10

Last Modified

2026-03-11

Generated

2026-07-06

AI Q&A

2026-03-10

EPSS Evaluated

2026-07-05

NVD

CVE-2026-30938

EUVD

EUVD-2026-10547

Affected Vendors & Products

Vendor	Product	Version / Range
parseplatform	parse-server	From 9.0.0 (inc) to 9.5.1 (exc)
parseplatform	parse-server	to 8.6.12 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

[{'type': 'paragraph', 'content': "CVE-2026-30938 is a vulnerability in the Parse Server's requestKeywordDenylist feature, which is designed to block requests containing prohibited keywords."}, {'type': 'paragraph', 'content': 'Due to a logic bug, the denylist scanning can be bypassed by placing any nested object or array before a forbidden keyword in the request payload. This happens because the scanning logic stops checking sibling keys after encountering the first nested value, allowing attackers to evade detection.'}, {'type': 'paragraph', 'content': 'This bypass applies to all custom denylist entries configured by developers and affects all Parse Server deployments with the denylist enabled by default.'}, {'type': 'paragraph', 'content': 'The vulnerability was fixed in Parse Server versions 8.6.12 and 9.5.1-alpha.1 by improving the scanning logic to properly inspect nested objects.'}] [1, 2, 3]

Impact Analysis

This vulnerability allows attackers to bypass keyword-based denylist filters, potentially enabling them to send requests containing prohibited keywords that would otherwise be blocked.

Because the vulnerability can be exploited remotely without any privileges or user interaction, it poses a risk of unauthorized modification of system data (integrity impact).

There is no impact on confidentiality or availability, but the integrity of data handled by Parse Server can be compromised.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

To mitigate the CVE-2026-30938 vulnerability in Parse Server, immediately upgrade your Parse Server deployment to version 8.6.12 or later, or 9.5.1-alpha.1 or later, where the issue with the requestKeywordDenylist bypass has been fixed.

As an additional mitigation, implement a Cloud Code beforeSave trigger to validate incoming data for prohibited keywords across all classes, ensuring that requests containing forbidden keywords are blocked even if the denylist bypass is attempted.

Hi! I’m here to help you understand CVE-2026-30938. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70