Description Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.55 and 9.6.0-alpha.44, an attacker can send an unauthenticated HTTP request with a deeply nested query containing logical operators to permanently hang the Parse Server process. The server becomes completely unresponsive and must be manually restarted. This is a bypass of the fix for CVE-2026-32944. This issue has been patched in versions 8.6.55 and 9.6.0-alpha.44.
A denial-of-service vulnerability has been identified in Parse Server, an open-source backend framework that runs on Node.js. This issue affects versions prior to 8.6.55 and 9.6.0-alpha.44. The vulnerability allows an attacker to send an unauthenticated HTTP request with a deeply nested query that includes logical operators. This query can cause the Parse Server process to hang indefinitely, rendering the server unresponsive and requiring a manual restart. Notably, this vulnerability bypasses a previous fix implemented for CVE-2026-32944.
Users can upgrade to Parse Server versions 8.6.55 or 9.6.0-alpha.44, both of which include the necessary patch. Instructions for upgrading can be found in the Parse Server documentation.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 26, 2026 Exploitation: NoneAutomatable: YesTechnical Impact: Partial
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions parseplatform parse-server < 8.6.55
>= 9.0.0, < 9.6.0
9.6.0 alpha1
9.6.0 alpha10
9.6.0 alpha11
9.6.0 alpha12
9.6.0 alpha13
9.6.0 alpha14
9.6.0 alpha15
9.6.0 alpha16
9.6.0 alpha17
9.6.0 alpha18
9.6.0 alpha19
9.6.0 alpha2
9.6.0 alpha20
9.6.0 alpha21
9.6.0 alpha22
9.6.0 alpha23
9.6.0 alpha24
9.6.0 alpha25
9.6.0 alpha26
9.6.0 alpha27
9.6.0 alpha28
9.6.0 alpha29
9.6.0 alpha3
9.6.0 alpha30
9.6.0 alpha31
9.6.0 alpha32
9.6.0 alpha33
9.6.0 alpha34
9.6.0 alpha35
9.6.0 alpha36
9.6.0 alpha37
9.6.0 alpha38
9.6.0 alpha39
9.6.0 alpha4
9.6.0 alpha40
9.6.0 alpha41
9.6.0 alpha42
9.6.0 alpha43
9.6.0 alpha5
9.6.0 alpha6
9.6.0 alpha7
9.6.0 alpha8
9.6.0 alpha9
Viewing 5 of 45 versions. View all CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha35:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha36:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha37:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha38:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha39:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha40:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha41:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha42:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha43:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9:*:*:*:node.js:*:* Remediation No remediation found in references.
Change History 4 change records found show changes