CVE-2026-33508

high-risk
Published 2026-03-24

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45.

Do I need to act?

-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Parseplatform

References (5)

Patch https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aab...
Patch https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3...
Issue Tracking https://github.com/parse-community/parse-server/pull/10259
Issue Tracking https://github.com/parse-community/parse-server/pull/10260
Vendor Advisory https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6...
51
/ 100
high-risk
Severity 26/34 · High
Exploitability 0/34 · Minimal
Exposure 25/34 · High