CVE-2026-33498

high-risk
Published 2026-03-24

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.55 and 9.6.0-alpha.44, an attacker can send an unauthenticated HTTP request with a deeply nested query containing logical operators to permanently hang the Parse Server process. The server becomes completely unresponsive and must be manually restarted. This is a bypass of the fix for CVE-2026-32944. This issue has been patched in versions 8.6.55 and 9.6.0-alpha.44.

Do I need to act?

-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Parseplatform

References (5)

Patch https://github.com/parse-community/parse-server/commit/2581b5426047ce9cbcd3d9c0e...
Patch https://github.com/parse-community/parse-server/commit/85994eff9e7b34cac7e1a2f57...
Issue Tracking https://github.com/parse-community/parse-server/pull/10257
Issue Tracking https://github.com/parse-community/parse-server/pull/10258
Vendor Advisory https://github.com/parse-community/parse-server/security/advisories/GHSA-9fjp-q3...
51
/ 100
high-risk
Severity 26/34 · High
Exploitability 0/34 · Minimal
Exposure 25/34 · High