6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30938

CVE-2026-30938: Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request payload. This is caused by a logic bug that stops scanning sibling keys after encountering the first nested value. Any custom requestKeywordDenylist entries configured by the developer are equally by-passable using the same technique. All Parse Server deployments are affected. The requestKeywordDenylist is enabled by default. This vulnerability is fixed in 8.6.12 and 9.5.1-alpha.1. Use a Cloud Code beforeSave trigger to validate incoming data for prohibited keywords across all classes.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30938

CVE-2026-30938:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	< 8.6.12	8.6.12
parse-server	npm	>= 9.0.0-alpha.1, < 9.5.1-alpha.1	9.5.1-alpha.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The security vulnerability is a bypass of the requestKeywordDenylist in Parse Server. The root cause is a logical flaw in the Utils.objectContainsKeyValue function, which was responsible for scanning incoming request data for prohibited keywords. The function used a recursive approach to traverse nested objects. However, it would prematurely exit the scanning loop after processing the first nested object it encountered, failing to check any other keys at the same level. The patch replaces this flawed recursive logic with an iterative, stack-based approach. This ensures that all keys within the request payload are scanned, regardless of their position relative to nested objects, thus closing the bypass vulnerability. The primary vulnerable function is Utils.objectContainsKeyValue as it contains the flawed logic.

Vulnerable functions

Utils.objectContainsKeyValue

src/Utils.js

The vulnerability lies in the recursive implementation of the `objectContainsKeyValue` function. The function would immediately return after encountering and processing the first nested object or array within a loop (`return Utils.objectContainsKeyValue(v, key, value);`). This behavior prevented the function from scanning any subsequent sibling keys in the same object, allowing an attacker to bypass the `requestKeywordDenylist` by placing a nested object before a prohibited keyword in the request payload.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.