CVE-2026-32944: Parse Server crash via deeply nested query condition operators

Published Mar 17, 2026
·
Updated

Impact

An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.

Patches

A depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.

Workarounds

None.

Other sources

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0-alpha.21 and 8.6.45, a depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available.

MITRE

Affected Software

25 affected componentsFixes available
Parse Parse Server<9.6.0-alpha.21, <8.6.45
npm/parse-server<8.6.45
8.6.45
npm/parse-server>=9.0.0<9.6.0-alpha.21
9.6.0-alpha.21
parseplatform Parse-server Node.js<8.6.45
parseplatform Parse-server Node.js>=9.0.0<9.6.0
parseplatform Parse-server Node.js=9.6.0-alpha1
parseplatform Parse-server Node.js=9.6.0-alpha10
parseplatform Parse-server Node.js=9.6.0-alpha11
parseplatform Parse-server Node.js=9.6.0-alpha12
parseplatform Parse-server Node.js=9.6.0-alpha13
parseplatform Parse-server Node.js=9.6.0-alpha14
parseplatform Parse-server Node.js=9.6.0-alpha15
parseplatform Parse-server Node.js=9.6.0-alpha16
parseplatform Parse-server Node.js=9.6.0-alpha17
parseplatform Parse-server Node.js=9.6.0-alpha18
parseplatform Parse-server Node.js=9.6.0-alpha19
parseplatform Parse-server Node.js=9.6.0-alpha2
parseplatform Parse-server Node.js=9.6.0-alpha20
parseplatform Parse-server Node.js=9.6.0-alpha3
parseplatform Parse-server Node.js=9.6.0-alpha4
parseplatform Parse-server Node.js=9.6.0-alpha5
parseplatform Parse-server Node.js=9.6.0-alpha6
parseplatform Parse-server Node.js=9.6.0-alpha7
parseplatform Parse-server Node.js=9.6.0-alpha8
parseplatform Parse-server Node.js=9.6.0-alpha9

Event History

Mar 17, 2026
Advisory Published
via GitHub·05:35 PM
Data Sourced
via GitHub·05:35 PM
DescriptionWeaknessAffected Software
Mar 18, 2026
CVE Published
via MITRE·09:50 PM
Data Sourced
via MITRE·09:50 PM
DescriptionWeakness
Data Sourced
via NVD·10:16 PM
DescriptionSeverityWeaknessAffected Software
Mar 31, 58197
Event
via FIRST·01:31 PM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-32944?

CVE-2026-32944 is a critical vulnerability as it allows unauthenticated attackers to crash the Parse Server process.

2

How do I fix CVE-2026-32944?

To fix CVE-2026-32944, upgrade your Parse Server to version 8.6.46 or newer, or to 9.6.0-alpha.22 or newer.

3

What are the affected versions of Parse Server for CVE-2026-32944?

Affected versions include Parse Server versions prior to 8.6.46 and between 9.0.0 and 9.6.0-alpha.21.

4

Is CVE-2026-32944 exploitable remotely?

Yes, CVE-2026-32944 is remotely exploitable as it can be triggered by sending a crafted request from an unauthenticated attacker.

5

What are the consequences of a successful exploit of CVE-2026-32944?

A successful exploit of CVE-2026-32944 can result in a denial of service, causing the Parse Server to crash and terminate.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203