GitHub Advisoryadvisory · npm
GHSA-6qh5-m6g3-xhq6 Parse Server LiveQuery subscription query depth bypass
HIGH
Official page ↗
- Aliases
- CVE-2026-33508
- Ecosystem
- npm
- Packages
- parse-server
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-674
- Reviewed
- 2026-03-20
Affected packages
• npm parse-server: >= 9.0.0, < 9.6.0-alpha.45 → fixed in 9.6.0-alpha.45
• npm parse-server: < 8.6.56 → fixed in 8.6.56
Description
Impact
Parse Server's LiveQuery component does not enforce the `requestComplexity.queryDepth` configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.
Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.
Patches
The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same `requestComplexity.queryDepth` limit that already protects REST API queries.
Workarounds
There is no known workaround other than upgrading.
Related
Alias · CVE (1)
- CVE-2026-33508 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. vulnerability
Weakness · CWE (1)
- CWE-674 Uncontrolled Recursion weakness
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6 web
- https://nvd.nist.gov/vuln/detail/CVE-2026-33508 advisory
- https://github.com/parse-community/parse-server/pull/10259 web
- https://github.com/parse-community/parse-server/pull/10260 web
- https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899 web
- https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b web
- https://github.com/parse-community/parse-server package