要点
- CVE-2026-32944 は parse-server (parseplatform), parse-server に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
- 今後30日間に悪用される確率（EPSS）：0.50%（全脆弱性の 43.0% より高い）。
- 対処：9.6.0, 8.6.45, 9.6.0-alpha.21 以降に更新してください。
| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.45
| 9.6.08.6.45
|
| parse-server npm | ≥ 9.0.0, < 9.6.0-alpha.21< 8.6.45
| 9.6.0-alpha.218.6.45
|
概要
Impact
An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.
Patches
A depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.
Workarounds
None.
NVD の説明
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0-alpha.21 and 8.6.45, a depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン