EUVD-2026-13917
GHSA-6qh5-m6g3-xhq6
GHSA-96qp-8cmq-jvq8
GHSA-hgx2-28f8-6g2r
GHSA-r7mc-x6x7-cqxx
GHSA-v2hr-chj5-35fh
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionGitHub Advisory
Impact
Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.
Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.
Patches
The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same requestComplexity.queryDepth limit that already protects REST API queries.
Workarounds
There is no known workaround other than upgrading.
AnalysisAI
Parse Server's LiveQuery component fails to enforce query depth limits on WebSocket subscription requests, allowing attackers to send deeply nested logical operators that trigger excessive recursion and CPU consumption. This affects Parse Server deployments where the LiveQuery WebSocket endpoint is accessible to untrusted clients (pkg:npm/parse-server). A patch is available from the vendor with no known workarounds, and while no EPSS score or KEV listing is present, the availability of proof-of-concept code in the patch references suggests exploitation details are publicly documented.
Technical ContextAI
Parse Server is an open-source Backend-as-a-Service framework for Node.js (npm package parse-server) that provides REST and LiveQuery APIs for real-time database synchronization. The vulnerability stems from CWE-674 (Uncontrolled Recursion), where the LiveQuery WebSocket subscription handler fails to validate query condition depth using the existing requestComplexity.queryDepth configuration setting. While REST API queries already enforce this limit to prevent resource exhaustion attacks, the WebSocket-based LiveQuery component bypassed this validation, allowing arbitrarily deep nesting of logical operators (AND, OR, NOR) that cause recursive processing. This architectural inconsistency between the REST and WebSocket handlers created an attack surface for algorithmic complexity exploitation.
RemediationAI
Upgrade Parse Server to the patched version as detailed in the vendor security advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6, with specific patch implementations available in pull requests https://github.com/parse-community/parse-server/pull/10259 and https://github.com/parse-community/parse-server/pull/10260. The vendor explicitly states there is no known workaround other than upgrading, meaning temporary mitigations are not viable. Until patching is completed, consider restricting network access to the LiveQuery WebSocket endpoint through firewall rules, IP allowlists, or authentication requirements to limit exposure to trusted clients only, though this may impact legitimate functionality.
Same weakness CWE-674 – Uncontrolled Recursion
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today