要点
- CVE-2026-32944 是影响 parse-server (parseplatform), parse-server 的高危 (CVSS 7.5)漏洞。
- 未来 30 天内被利用的概率（EPSS）：0.50%，高于 43.0% 的漏洞。
- 修复：升级到 9.6.0, 8.6.45, 9.6.0-alpha.21 或更高版本。
| Package | Affected versions | Patched versions |
|---|
| parse-server | = 9.6.0≥ 9.0.0, < 9.6.0< 8.6.45
| 9.6.08.6.45
|
| parse-server npm | ≥ 9.0.0, < 9.6.0-alpha.21< 8.6.45
| 9.6.0-alpha.218.6.45
|
Description
Impact
An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.
Patches
A depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.
Workarounds
None.
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0-alpha.21 and 8.6.45, a depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free