Parse Server: Denial of service via exponential-time processing of deeply nested query operators
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1 and 8.6.82.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-57480US | — | — | ||
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9bWEB
- https://github.com/parse-community/parse-server/commit/1103c7a890e0455ba3dccd4bc5db17efe1789c9aWEB
- https://github.com/parse-community/parse-server/pull/10511WEB
- https://github.com/parse-community/parse-server/pull/10512WEB
- https://github.com/parse-community/parse-server/releases/tag/8.6.82WEB
- https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12WEB
- https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-57480WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan