CVE-2026-57480
parse-server: Denial of service via exponential-time processing of deeply nested query operators
Description
### Impact Parse Server is vulnerable to denial of service. A remote attacker can send a single, small query (~1 KB) containing deeply nested query condition operators. Parse Server processes the nested structure with exponential time complexity, which blocks the Node.js event loop and makes the server unresponsive to all clients for the duration of processing. A single request can occupy the event loop for many seconds, and the request is repeatable. The issue affects the REST API and LiveQuery query handling and is reachable in the default configuration. Exploitation requires only the public application identifier; no user authentication is needed. ### Patches The internal query-traversal helper that previously re-walked nested arrays — causing exponential-time processing of nested `$or`/`$and`/`$nor` operators — was corrected to traverse queries in linear time. Additionally, the optional `requestComplexity.queryDepth` limit was generalized so that nested logical operators are counted even when wrapped inside field-level operators (e.g. `$elemMatch`, `$not`) or plain field names, closing a bypass of the limit on both the REST API and LiveQuery. ### Workarounds There is no complete configuration-only workaround on affected versions. Setting `requestComplexity.queryDepth` to a small positive integer reduces exposure but does not fully prevent the issue, because the limit can be bypassed by nesting the operators inside a field-level operator. Upgrading is strongly recommended.
How to fix CVE-2026-57480
To remediate CVE-2026-57480, upgrade the affected package to a fixed version below.
- —upgrade to 8.6.82 or later
- —upgrade to 9.9.1-alpha.12 or later
Is CVE-2026-57480 being exploited?
Low — EPSS is 0.3%, meaning exploitation activity has not been observed at scale.