CVE-2026-31871 is a critical SQL injection in Parse Server's PostgreSQL adapter, scored 9.8. The sub-key name in an Increment on a nested field is placed into SQL string literals without escaping. Upgrade to 8.6.31 or 9.6.0-alpha.5, or later.
What's affected
Parse Server on PostgreSQL before 8.6.31 and before 9.6.0-alpha.5. Only Postgres deployments are affected, per the record.
It needs write access to the REST API. This is a sibling of CVE-2026-31856, which hits the same Increment path through the amount value rather than the key name. Fixes for both landed in different releases, so do not assume the earlier patch covers this one.
How to check if you're exposed
Parse Server is usually installed from npm, so the quickest check is your lockfile or the installed package.
npm ls parse-server
If you run the official Docker image, read the image tag you deploy and compare it with the fixed releases. Then confirm which database you use. This issue only applies to deployments backed by PostgreSQL, so a MongoDB only install is outside its scope.
What to do now
- Upgrade Parse Server to 8.6.31 or later, or 9.6.0-alpha.5 or later.
- Prefer the newest release on your line, which also carries the later fixes in this family.
- Rebuild and redeploy container images that bundle the old version.
- Audit API write access and rotate keys that were shared widely.
Why it matters
The class is CWE-89. Quoting a value for SQL is easy to get slightly wrong, and a sub-key name that contains a single quote can end a string early. The record says this could allow commands to run or data to be read, bypassing class level permissions and ACLs.
A run of closely related SQL injection fixes in one adapter is a good reason to move to a current release instead of patching one CVE at a time.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
How is this different from CVE-2026-31856?
Both are in the PostgreSQL adapter's Increment handling. One concerns the amount value, this one the sub-key name. They were fixed in different releases.
Do ORMs or parameterized queries prevent this?
Parameterization would. The advisory says these values were interpolated into the SQL text, which is the gap.
Sources
Last reviewed: 19 October 2026.
