| Package | Affected versions | Patched versions |
|---|---|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.45 | 9.6.08.6.45 |
| parse-server | ≥ 9.0.0, < 9.6.0-alpha.21< 8.6.45 | 9.6.0-alpha.218.6.45 |
An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.
A depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.
None.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free