CVE-2026-33498: Parse Server: Query condition depth bypass via pre-validation transform pipeline
Impact
An attacker can send an unauthenticated HTTP request with a deeply nested query containing logical operators to permanently hang the Parse Server process. The server becomes completely unresponsive and must be manually restarted. This is a bypass of the fix for CVE-2026-32944.
Patches
The query condition nesting depth is now validated before the query enters the transformation pipeline, preventing deeply nested structures from being recursively processed before the existing depth guard can fire.
Workarounds
None.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.55 and 9.6.0-alpha.44, an attacker can send an unauthenticated HTTP request with a deeply nested query containing logical operators to permanently hang the Parse Server process. The server becomes completely unresponsive and must be manually restarted. This is a bypass of the fix for CVE-2026-32944. This issue has been patched in versions 8.6.55 and 9.6.0-alpha.44.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33498?
CVE-2026-33498 is considered to be a critical vulnerability due to its ability to cause the Parse Server process to hang permanently.
How do I fix CVE-2026-33498?
To fix CVE-2026-33498, update to Parse Server version 8.6.55 or version 9.6.0-alpha.44.
What impact does CVE-2026-33498 have on my server?
CVE-2026-33498 can cause your Parse Server to become completely unresponsive, requiring a manual restart.
Is CVE-2026-33498 a bypass of other vulnerabilities?
Yes, CVE-2026-33498 is a bypass of the fix implemented for CVE-2026-32944.
What should I monitor for regarding CVE-2026-33498?
Monitor for unauthorized HTTP requests with deeply nested queries that may exploit CVE-2026-33498.