Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

Description

The requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request payload. This is caused by a logic bug that stops scanning sibling keys after encountering the first nested value.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 9.0.0-alpha.1, < 9.5.1-alpha.1

  < 8.6.12**

• Patched version(s): **9.5.1-alpha.1

  8.6.12**

References

• GHSA-q342-9w2p-57fp
• CVE-2026-30938
• CWE-693
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter - CVE-2026-33539
• Parse Server has a protected fields bypass via dot-notation in query and sort - CVE-2026-31872
• Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries - CVE-2026-32728
• Parse Server has a password reset token single-use bypass via concurrent requests - CVE-2026-32943

Tags:

npm

parse-server