CVE-2026-32944 - Vulnerability Details

- Parse Server crash via deeply nested query condition operators

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0-alpha.21 and 8.6.45, a depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available.

Published: 2026-03-18

Score: 8.7 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Parse Server allows an unauthenticated attacker to send a request containing deeply nested query condition operators that causes the server process to crash. The crash terminates the service, denying access to all connected clients. The vulnerability is rooted in improper limit validation (CWE-674) and results in a denial of service rather than code execution or data exposure.

Affected Systems

The affected product is Parse Server from Parse Community. Versions prior to 9.6.0‑alpha.21 and 8.6.45 are vulnerable. All earlier releases should be considered at risk until upgraded.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity. The EPSS score is under 1%, suggesting a low probability of widespread exploitation, and the vulnerability is not listed in the CISA KEV catalog. Because the attack vector is unauthenticated and only requires sending a specially crafted HTTP request, the risk is that any user with network access to the server could trigger the crash. The mitigation introduced a requestComplexity.queryDepth option, which limits nesting but is disabled by default to avoid breaking changes.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

parse-community

parse-server

affected

Version	Status	Constraints
`>= 9.0.0, < 9.6.0-alpha.21`	affected	—
`< 8.6.45`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:parseplatform:parse-server::::::node.js::*
	cpe:2.3:a:parseplatform:parse-server::::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8::::node.js::*
	cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9::::node.js::*

No data.

Vendor Product Confidence Versions

Parse Community

Parse Server

100%

Version	Status	Scheme	Platform
`[9.0.0,9.6.0-alpha.21)`	affected	semver	—
`[0,8.6.45)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade Parse Server to version 9.6.0‑alpha.21 or later, or 8.6.45 or later.
Enable the requestComplexity.queryDepth option and configure an appropriate nesting limit to prevent the crash.
Monitor Parse Server logs for anomalous query depth requests and verify that the limit functions correctly after the upgrade.

Generated by OpenCVE AI on March 19, 2026 at 18:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Github GHSA	GHSA-9xp9-j92r-p88v	Parse Server crash via deeply nested query condition operators

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00017.

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/parse-community/parse-server/pull/10202
https://github.com/parse-community/parse-server/pull/10203
https://github.com/parse-community/parse-server/security/advisories/GHSA-9xp9-j92r-p88v

History

Thu, 19 Mar 2026 17:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 19 Mar 2026 17:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Parseplatform Parseplatform parse-server
CPEs		cpe:2.3:a:parseplatform:parse-server::::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha12::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha13::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha14::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha15::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha16::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha17::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha18::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha19::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha20::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha2::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha3::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha4::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha5::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha6::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha7::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha8::::node.js::* cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha9::::node.js::*
Vendors & Products		Parseplatform Parseplatform parse-server
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Thu, 19 Mar 2026 09:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Parse Community Parse Community parse Server
Vendors & Products		Parse Community Parse Community parse Server

Wed, 18 Mar 2026 22:15:00 +0000

Type	Values Removed	Values Added
Description		Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0-alpha.21 and 8.6.45, a depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available.
Title		Parse Server crash via deeply nested query condition operators
Weaknesses		CWE-674
References		https://github.com/parse-community/parse-server/pull/10202 https://github.com/parse-community/parse-server/pull/10203 https://github.com/parse-community/parse-server/security/advisories/GHSA-9xp9-j92r-p88v
Metrics		cvssV4_0 `{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}`

Subscriptions

Parse Community Parse Server

Parseplatform Parse-server

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2026-03-18T21:50:08.390Z

Updated: 2026-03-19T16:56:38.160Z

Reserved: 2026-03-17T00:05:53.283Z

Link: CVE-2026-32944

Vulnrichment

Updated: 2026-03-19T16:56:34.293Z

NVD

Status : Analyzed

Published: 2026-03-18T22:16:25.970

Modified: 2026-03-19T16:46:28.467

Link: CVE-2026-32944

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-03-25T11:51:59Z

Weaknesses

CWE-674

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object