Description Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45.
A denial-of-service vulnerability has been identified in the LiveQuery component of Parse Server, affecting versions prior to 8.6.56 and 9.6.0-alpha.45. The issue arises because the LiveQuery WebSocket subscription requests do not properly enforce the 'requestComplexity.queryDepth' configuration. This oversight allows an attacker to send subscriptions with deeply nested logical operators, leading to excessive recursion and CPU usage, which can degrade or disrupt service availability. The vulnerability is exploitable when the LiveQuery WebSocket endpoint is accessible to untrusted clients.
Users can upgrade to Parse Server versions 8.6.56 or 9.6.0-alpha.45, both of which include the necessary patch to address this vulnerability.
Show AI summary Metrics CVSS Version 4.0 CVSS Version 3.x CVSS Version 2.0 SSVC
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 25, 2026 Exploitation: NoneAutomatable: NoTechnical Impact: Partial
References to Advisories, Solutions, and Tools By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration Affected Products Product Versions parseplatform parse-server < 8.6.56
>= 9.0.0, < 9.6.0
9.6.0 alpha1
9.6.0 alpha10
9.6.0 alpha11
9.6.0 alpha12
9.6.0 alpha13
9.6.0 alpha14
9.6.0 alpha15
9.6.0 alpha16
9.6.0 alpha17
9.6.0 alpha18
9.6.0 alpha19
9.6.0 alpha2
9.6.0 alpha20
9.6.0 alpha21
9.6.0 alpha22
9.6.0 alpha23
9.6.0 alpha24
9.6.0 alpha25
9.6.0 alpha26
9.6.0 alpha27
9.6.0 alpha28
9.6.0 alpha29
9.6.0 alpha3
9.6.0 alpha30
9.6.0 alpha31
9.6.0 alpha32
9.6.0 alpha33
9.6.0 alpha34
9.6.0 alpha35
9.6.0 alpha36
9.6.0 alpha37
9.6.0 alpha38
9.6.0 alpha39
9.6.0 alpha4
9.6.0 alpha40
9.6.0 alpha41
9.6.0 alpha42
9.6.0 alpha43
9.6.0 alpha44
9.6.0 alpha5
9.6.0 alpha6
9.6.0 alpha7
9.6.0 alpha8
9.6.0 alpha9
Viewing 5 of 46 versions. View all CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha21:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha22:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha23:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha24:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha25:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha26:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha27:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha28:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha29:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha30:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha31:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha32:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha33:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha34:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha35:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha36:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha37:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha38:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha39:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha40:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha41:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha42:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha43:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha44:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8:*:*:*:node.js:*:* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9:*:*:*:node.js:*:* Remediation No remediation found in references.
Change History 4 change records found show changes