🛡️ CVE-2026-32594 — parse

🟠 CVSS 7.3 — High ✅ No Known Exploit OSV
7.3
CVSS Score
0 Low4 Medium7 High9 Critical10

Description

Parse Server's GraphQL WebSocket endpoint bypasses security middleware

Impact

Any Parse Server deployment that uses the GraphQL API is affected. The GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, introspection control, and query complexity limits. An attacker can connect to the WebSocket endpoint and execute GraphQL operations without providing a valid application or API key, access the GraphQL schema via introspection even when public introspection is disabled, and send arbitrarily complex queries that bypass configured complexity limits.

Patches

The unfinished GraphQL WebSocket subscription feature has been removed, including the createSubscriptions method and the subscriptions-transport-ws dependency. GraphQL subscriptions were never functional in Parse Server as the schema did not define any subscription types.

Workarounds

Block WebSocket upgrade requests to the GraphQL subscriptions path (by default /subscriptions) at the network level, for example using a reverse proxy or load balancer rule.

Affected software

CVE-2026-32594 is recorded against 2 packages.

  • parse
  • parse-server

Timeline and source

Published on 20 March 2026. No public exploit is currently recorded for this entry. Record sourced from OSV.

References

github.com (Web)
github.com (Web)
github.com (Web)
nvd.nist.gov (Web)

Details

Severity MEDIUM
CVSS Score 7.3
CVSS Vector N/A
CWE N/A
Public Exploit ✅ No
Source OSV
Published 2026-03-20
Updated 2026-08-12
Modified 2026-03-20
Fix URL N/A

Affected Packages

Software From version Fixed in
parse — —
parse-server — —

Similar Threats

Site Security Check

Is parse part of your stack?

CVE-2026-32594 is rated CVSS 7.3 High. BotEraser scans your installation against known CVE records and tells you whether this vulnerability applies to the versions you actually run.

Scan My Site Free →

No credit card required  ·  Results in minutes

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the vulnerabilities listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.