Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-30854
5.3
MEDIUMCVSS v3
Published
March 7, 2026
Affected
2 projects
Assigned by
GitHub
Severity scale
010
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.g. ... on Query { __type(name:"User") { name } }) bypass the introspection control, allowing unauthenticated users to perform type reconnaissance. __schema introspection is not affected. This issue has been patched in version 9.5.0-alpha.10.
parse-community/parse-server
GitHubParse Server for Node.js / Express
GitHubParse Server for Node.js / Express>= 9.4.0, < 9.5.0, = 9.3.1, = 9.5.0, >= 9.3.1-alpha.3, < 9.5.0-alpha.10NVD
parse-server
NPMAn express module providing a Parse-compatible API server
NPMAn express module providing a Parse-compatible API server>= 9.4.0, < 9.5.0, = 9.3.1, = 9.5.0, >= 9.3.1-alpha.3, < 9.5.0-alpha.10OSV