CVE-2026-31856 is a critical SQL injection in Parse Server's PostgreSQL storage adapter, scored 9.8. The amount in an Increment operation on a nested field was placed into the SQL query without parameterization. Upgrade to 8.6.29 or 9.6.0-alpha.3, or later.
What's affected
Parse Server deployments on PostgreSQL before 8.6.29 (8.x line) and before 9.6.0-alpha.3 (9.x alpha line). MongoDB deployments are stated as not affected.
The trigger is an Increment operation on a nested object field written with dot notation, such as a counter inside a stats object. It needs the ability to send write requests to the REST API.
How to check if you're exposed
Parse Server is usually installed from npm, so the quickest check is your lockfile or the installed package.
npm ls parse-server
If you run the official Docker image, read the image tag you deploy and compare it with the fixed releases. Then confirm which database you use. This issue only applies to deployments backed by PostgreSQL, so a MongoDB only install is outside its scope.
What to do now
- Upgrade to Parse Server 8.6.29 or later, or 9.6.0-alpha.3 or later on the 9.x alpha line.
- If you are already planning an upgrade, go straight to the newest release on your line, because several Parse Server SQL injection fixes landed within days of each other.
- Review who holds write access to the REST API, including old API keys and master key use in client code.
- Look through database logs for failed or odd statements around increment writes.
Why it matters
This is CWE-89. A value that should have been treated as a number was interpolated straight into SQL text. The advisory says an attacker who can send write requests could read any data from the database and get around class level permissions and ACLs, because the injected query runs below those checks.
That last point is the reason this class is dangerous in backend as a service platforms. Permission rules live in the application layer, and SQL injection steps around them.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Is a MongoDB deployment exposed?
The advisory says MongoDB deployments are not affected.
Does the master key matter here?
The advisory describes an attacker who can send write requests to the REST API. Keep the master key out of clients and reduce who can write at all.
Sources
Last reviewed: 19 October 2026.
