CVE-2026-32944High▾ TwilightParse Server crash via deeply nested query condition operators
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.5%
An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.
A depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.
None.
parse-server >= 9.0.0, < 9.6.0-alpha.21parse-server < 8.6.45Upgrade to a patched release:
parse-server 9.6.0-alpha.21parse-server 8.6.45Connected by shared product, vendor, weakness, or advisory.
GHSA-593v-wcqx-hq2wHigh· 7.5Incorrect version tags linked to external repository
GHSA-p6c5-mjgj-m4rmLowDuplicate Advisory: Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist
CVE-2026-32594MediumParse Server's GraphQL WebSocket endpoint bypasses security middleware
CVE-2026-61448LowParse Server is affected by a stored cross-site scripting (XSS) vulnerability in versions >= 9.0.0, < 9.10.0-alpha.2 and <= 8.6.83
GHSA-cgxm-vr2f-6fj8Highparse-server: Denial of service via exponential-time processing of deeply nested query operators
CVE-2026-50008Mediumparse-server: Server option routeAllowList is bypassable through batch sub-requests