CVE-2026-57480— Parse Server: Denial of service via exponential-time processing of deeply nested query operators
Possible ATT&CK Techniques 1AI
T1496 · Resource HijackingAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| parse-community | parse-server | >= 9.0.0-alpha.1, < 9.9.1-alpha.12 | affected |
< 8.6.82 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-57480
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Parse Server: Denial of service via exponential-time processing of deeply nested query operators
Source: CVE Program / CVE List V5
Vulnerability Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
算法复杂性
Source: CVE Program / CVE List V5
Vulnerability Title
Parse Platform Parse Server 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Parse Platform Parse Server是Parse Platform组织开源的一个开源后端,可以部署到任何可以运行 Node.js 的基础设施。 Parse Platform Parse Server 9.9.1-alpha.12之前版本和8.6.82之前版本存在资源管理错误漏洞，该漏洞源于REST API或LiveQuery查询处理中深度嵌套的$or、$and、$nor查询条件运算符可能触发内部查询遍历助手中的指数时间处理并阻塞Node.js事件循环，可能导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| parse-community | parse-server | >= 9.0.0-alpha.1, < 9.9.1-alpha.12 | - |
II. Public POCs for CVE-2026-57480
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-57480
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-57480 (5)
- 🔗 Release 9.9.1-alpha.12 · parse-community/parse-server · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-57480 (1)
Vendor Pages for CVE-2026-57480 (1)
- 🔗 Release 8.6.82 · parse-community/parse-server · GitHubx_refsource_MISC
Same Patch Batch · parse-community · 2026-07-08 · 3 CVEs total
| CVE-2026-57481 | Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access ch | |
| CVE-2026-55778 | Parse Server: Stored XSS via non-standard file extension bypassing file upload extension b |
IV. Related Vulnerabilities
Same product: parse-server
- CVE-2026-66009
Parse Server 9.0.0 Information Disclosure via GraphQL Error - CVE-2026-66008
Parse Server 9.0.0 Information Disclosure via GraphQL Error - CVE-2026-64627
Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Co - CVE-2026-61448
Parse Server 9.0.0 Stored XSS via malformed Content-Type - CVE-2026-57481
Parse Server: LiveQuery discloses object data to a subscribe
Same vendor: parse-community
- CVE-2026-66009
Parse Server 9.0.0 Information Disclosure via GraphQL Error - CVE-2026-66008
Parse Server 9.0.0 Information Disclosure via GraphQL Error - CVE-2026-64627
Parse Server 9.0.0 Schema Disclosure via GraphQL Variable Co - CVE-2026-61448
Parse Server 9.0.0 Stored XSS via malformed Content-Type - CVE-2026-57481
Parse Server: LiveQuery discloses object data to a subscribe
Same weakness: CWE-407
- CVE-2026-67216
cJSON cJSON_Compare Exponential Complexity Denial of Service - CVE-2026-64644
Next.js: Denial of Service in the Image Optimization API usi - CVE-2026-55968
Apache Thrift: Node.js quadratic-time DoS in server receive - CVE-2026-65623
Quadratic CPU blow-up reassembling fragmented WebSocket mess - CVE-2026-13064
MongoDB $jsonSchema Query Operator Excessive CPU Consumption
V. Comments for CVE-2026-57480
No comments yet