CVE-2026-57480
CVE-2026-57480 · Parse Server: Denial of service via exponential-time processing of deeply nested query operators
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.
CVSS 8.7 · Alta · EPSS 0,6% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
parse-server
- Versiones
- >= 9.0.0-alpha.1, < 9.9.1-alpha.12: Afectada
- < 8.6.82: Afectada
Sin corrección publicada
parse-server npm
- Intervalos de versiones afectados
- SEMVER: ≥ 9.0.0, < 9.9.1-alpha.12
Actualiza a 9.9.1-alpha.12
parse-server npm
- Intervalos de versiones afectados
- SEMVER: < 8.6.82
Actualiza a 8.6.82
Fuentes originales
- https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8
- https://github.com/parse-community/parse-server/pull/10511
- https://github.com/parse-community/parse-server/pull/10512
- https://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9b
- https://github.com/parse-community/parse-server/commit/1103c7a890e0455ba3dccd4bc5db17efe1789c9a
- https://github.com/parse-community/parse-server/releases/tag/8.6.82
- https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12
- https://nvd.nist.gov/vuln/detail/CVE-2026-57480