CVE-2026-31840 is a critical SQL injection in Parse Server, scored 9.8 by NVD. It affects deployments on PostgreSQL, where a dot-notation field name combined with the sort query parameter reaches the database without proper escaping. Upgrade to Parse Server 8.6.28 or 9.6.0-alpha.2, or any later release.
What's affected
Parse Server versions before 9.6.0-alpha.2 and before 8.6.28. The advisory says the same weakness may also touch queries that use dot-notation field names with the distinct and where parameters.
Only deployments that use a PostgreSQL database are affected. MongoDB deployments are not mentioned as affected in the record.
Fixed versions: 8.6.28 on the 8.x line and 9.6.0-alpha.2 on the 9.x alpha line.
How to check if you're exposed
Parse Server is usually installed from npm, so the quickest check is your lockfile or the installed package.
npm ls parse-server
If you run the official Docker image, read the image tag you deploy and compare it with the fixed releases. Then confirm which database you use. This issue only applies to deployments backed by PostgreSQL, so a MongoDB only install is outside its scope.
What to do now
- Upgrade Parse Server to 8.6.28 or later on the 8.x line, or 9.6.0-alpha.2 or later if you track the 9.x alpha builds.
- Redeploy every instance and worker that runs Parse Server, not just the primary one.
- Check your database logs for unusual queries against class tables that use sort with dotted field names.
- If you cannot upgrade today, limit who can reach the REST API until you can. I could not confirm a configuration workaround, so read the advisory for current guidance.
Why it matters
The weakness class is CWE-89, SQL injection. The code that builds the query handled sub-field values in dot-notation incorrectly, so text meant to be a field name could change the SQL statement itself.
The CVSS vector is network based, needs no privileges and no user interaction. That is why it scores 9.8: anyone who can send a query to an exposed API could try it. Backends that sit directly on the internet deserve the first patch window.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect Parse Server on MongoDB?
The record says the issue only affects deployments using a PostgreSQL database. Still upgrade, since other fixes ship in the same releases.
Which release should I pick?
Use 8.6.28 or later if you run the 8.x line. Use 9.6.0-alpha.2 or later if you run the 9.x alpha line. Read the release notes before moving between major lines.
Sources
Last reviewed: 19 October 2026.
