Parse Server: Denial of service via exponential-time processing of deeply nested query operators
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1 and 8.6.82.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-57480US | — | — | ||
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9bWEB
- https://github.com/parse-community/parse-server/commit/1103c7a890e0455ba3dccd4bc5db17efe1789c9aWEB
- https://github.com/parse-community/parse-server/pull/10511WEB
- https://github.com/parse-community/parse-server/pull/10512WEB
- https://github.com/parse-community/parse-server/releases/tag/8.6.82WEB
- https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12WEB
- https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-57480WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan