{"id":"CVE-2026-32944","aliases":["GHSA-9xp9-j92r-p88v"],"title":"Parse Server crash via deeply nested query condition operators","summary":"Parse Server crash via deeply nested query condition operators","severity":"high","cwe":["CWE-674"],"vendor":"parse-server","product":"parse-server","ecosystem":"npm","affected":["parse-server >= 9.0.0, < 9.6.0-alpha.21","parse-server < 8.6.45"],"patched":["parse-server 9.6.0-alpha.21","parse-server 8.6.45"],"published":"2026-03-17","updated":"2026-11-09","sourceUpdated":"2026-11-09T01:43:35Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-9xp9-j92r-p88v","references":[{"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-9xp9-j92r-p88v"},{"url":"https://github.com/parse-community/parse-server/pull/10202"},{"url":"https://github.com/parse-community/parse-server/pull/10203"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-32944"},{"url":"https://github.com/advisories/GHSA-9xp9-j92r-p88v"}],"tags":["ghsa","npm"],"epss":0.00513,"epssPercentile":0.43995,"ingestedAt":"2026-11-09T02:01:54.433Z","slug":"CVE-2026-32944","body":"## Overview\n\n### Impact\n\nAn unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.\n\n### Patches\n\nA depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.\n\n### Workarounds\n\nNone.\n\n## Affected packages\n\n- `parse-server >= 9.0.0, < 9.6.0-alpha.21`\n- `parse-server < 8.6.45`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `parse-server 9.6.0-alpha.21`\n- `parse-server 8.6.45`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}