CVE-2026-33508: Parse Server: LiveQuery subscription query depth bypass
Impact
Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.
Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.
Patches
The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same requestComplexity.queryDepth limit that already protects REST API queries.
Workarounds
There is no known workaround other than upgrading.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33508?
The severity of CVE-2026-33508 is classified as high due to the potential for excessive CPU consumption and denial-of-service conditions.
How do I fix CVE-2026-33508?
To fix CVE-2026-33508, upgrade to Parse Server version 8.6.56 or 9.6.0-alpha.45 or later.
What software is affected by CVE-2026-33508?
CVE-2026-33508 affects Parse Server versions prior to 8.6.56 and versions between 9.0.0 and 9.6.0-alpha.45.
What type of attacks does CVE-2026-33508 allow?
CVE-2026-33508 allows attackers to send deeply nested WebSocket subscription requests that can lead to denial-of-service through excessive recursion.
Is the LiveQuery component in Parse Server vulnerable in CVE-2026-33508?
Yes, the LiveQuery component of Parse Server is vulnerable in CVE-2026-33508 due to its failure to enforce the requestComplexity.queryDepth configuration.