Parse Server Denial of Service via Nested Query Operators

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: GitHub, Inc.

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-08

Last Modified

2026-07-08

Generated

2026-07-09

AI Q&A

2026-07-09

EPSS Evaluated

N/A

NVD

CVE-2026-57480

Affected Vendors & Products

Vendor	Product	Version / Range
parse_server	parse_server	to 9.9.1-alpha.12 (exc)
parse_server	parse_server	to 8.6.82 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-407	An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Parse Server versions prior to 9.9.1-alpha.12 and 8.6.82. It involves the handling of deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query processing. When such deeply nested queries are processed, they can cause exponential-time processing in the internal query-traversal helper, which in turn blocks the Node.js event loop.

Impact Analysis

The vulnerability can cause the Node.js event loop to be blocked due to exponential-time processing of certain deeply nested queries. This can lead to denial of service conditions where the backend becomes unresponsive or significantly slowed down, impacting the availability and performance of applications relying on Parse Server.

Mitigation Strategies

To mitigate this vulnerability, upgrade Parse Server to version 9.9.1-alpha.12 or later, or version 8.6.82 or later.

Hi! I’m here to help you understand CVE-2026-57480. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70