| パッケージ | 影響を受けるバージョン | 修正済みバージョン |
|---|---|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.56 | 9.6.08.6.56 |
| parse-server | ≥ 9.0.0, < 9.6.0-alpha.45< 8.6.56 | 9.6.0-alpha.458.6.56 |
Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.
Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.
The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same requestComplexity.queryDepth limit that already protects REST API queries.
There is no known workaround other than upgrading.
これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。
無料でサイトをスキャン