CVE-2026-32944: Parse Server crash via deeply nested query condition operators
Impact
An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.
Patches
A depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.
Workarounds
None.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0-alpha.21 and 8.6.45, a depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32944?
CVE-2026-32944 is a critical vulnerability as it allows unauthenticated attackers to crash the Parse Server process.
How do I fix CVE-2026-32944?
To fix CVE-2026-32944, upgrade your Parse Server to version 8.6.46 or newer, or to 9.6.0-alpha.22 or newer.
What are the affected versions of Parse Server for CVE-2026-32944?
Affected versions include Parse Server versions prior to 8.6.46 and between 9.0.0 and 9.6.0-alpha.21.
Is CVE-2026-32944 exploitable remotely?
Yes, CVE-2026-32944 is remotely exploitable as it can be triggered by sending a crafted request from an unauthenticated attacker.
What are the consequences of a successful exploit of CVE-2026-32944?
A successful exploit of CVE-2026-32944 can result in a denial of service, causing the Parse Server to crash and terminate.