Executive brief
Parse Server is a backend framework that provides rate limiting to protect APIs from abuse. An attacker can bypass this protection by bundling multiple requests into a single batch request, allowing them to circumvent rate limits and potentially conduct brute-force attacks or denial-of-service operations against rate-limited endpoints.
Technical details
Parse Server applies rate limiting at the Express middleware layer, but the /batch endpoint processes sub-requests by routing them directly through the internal Promise router, bypassing Express middleware including rate limiting. The vulnerability (CWE-799: improper control of interaction frequency) allows attackers to bundle multiple requests targeting rate-limited endpoints into a single batch request to circumvent configured rate limits. The attack is network-accessible with no authentication or user interaction required. A patch adds a pre-flight check in the batch handler that counts sub-requests per rate-limited path and rejects the batch if any path exceeds its configured limit. Patches are available in Parse Server 8.6.23 and 9.5.2-alpha.10.
Affected products
- Parse Community Parse Server All versions before 8.6.23; versions 9.0.0-alpha.1 through 9.5.2-alpha.9
Timeline
- 2026-03-10: disclosed: Vulnerability published
- 2026-03-10: patched: Fix released in Parse Server 8.6.23 and 9.5.2-alpha.10