EUVD-2026-42421Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed REST/LiveQuery endpoint
-
DeliveryCraft deeply nested $or/$and/$nor query
-
ExploitSubmit request to query API
-
ExecutionTrigger exponential traversal helper
-
PersistBlock Node.js event loop
-
ImpactBackend denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Algorithmic complexity limits
|
| Exploitation Conditions | Exploitation requires that the Parse Server REST API or LiveQuery interface be reachable by the attacker and that it accept queries using the $or, $and, or $nor boolean operators (standard, default-enabled query features - no non-default configuration is needed to reach the code path). Per the CVSS vector (PR:N/UI:N/AC:L), no authentication or user interaction is required and complexity is low. The primary limiting factor is network reachability: instances that keep the query API behind authentication, a WAF, IP allow-listing, or nesting/size limits are harder to reach, and installations not exposed to untrusted clients face reduced practical risk. Impact is limited to availability (event-loop stall / DoS) - there is no data disclosure or modification despite the source's 'Information Disclosure' tag. |
| Impact | The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with VA:H and VC:N/VI:N describes a pure availability impact reachable by an unauthenticated network attacker with low complexity and no user interaction - a classic algorithmic-complexity DoS, which is consistent with the 8.7 score and CWE-407. No EPSS score, KEV listing, POC, or SSVC decision data was provided, so real-world exploitation cannot be quantified from the input; however, the low attack complexity, lack of authentication, and event-loop-blocking nature make weaponization straightforward once the payload shape is known, and the fix is a public GitHub commit/PR pair that could be reverse-engineered. Note a data conflict: the source tags label this 'Information Disclosure,' but both the description and the CVSS vector (VC:N, VA:H) indicate availability loss only, not disclosure - the tags appear mislabeled and should not be relied upon. Overall this is a legitimate availability priority for internet-exposed Parse Server instances, but not a confidentiality/integrity threat. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a single crafted REST API (or LiveQuery) request containing a query with hundreds of nested $or/$and/$nor operators to an internet-exposed Parse Server. The server's query-traversal helper enters exponential-time processing on the main thread, blocking the Node.js event loop so that all other users' requests time out; repeating the request keeps the backend down. No public POC is referenced, but the payload is simple to construct from the description. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 08, 2026
Denial of service in Parse Server (versions prior to 8.6.82 and 9.9.1-alpha.12) allows remote attackers to hang the Node.js event loop by submitting deeply nested $or, $and, or $nor query operators through the REST API or LiveQuery interface, triggering exponential-time processing in the internal query-traversal helper. Because the vulnerable code path is reachable without authentication and consumes CPU without bound, a single crafted request can render the backend unresponsive to all clients. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
RemediationAI
Vendor-released patch: upgrade to Parse Server 8.6.82 (release: https://github.com/parse-community/parse-server/releases/tag/8.6.82) on the 8.x line, or to 9.9.1-alpha.12 (release: https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12) on the 9.x line; the fixes are in commits 0f5d2ad77b422dc904458254548be87397fc6e9b and 1103c7a890e0455ba3dccd4bc5db17efe1789c9a. Because 9.9.1-alpha.12 is a pre-release (alpha), production 9.x users should weigh stability trade-offs and consider staying on a patched 8.x build until a stable 9.x fix ships. If immediate patching is not possible, compensating controls include enforcing a maximum query-nesting depth or request-body size limit at a reverse proxy or WAF in front of Parse Server to reject deeply nested $or/$and/$nor structures (trade-off: may block legitimate complex queries), rate-limiting and requiring authentication on the REST and LiveQuery endpoints to reduce anonymous reachability, and restricting network exposure of the API to trusted clients. Consult the advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8 for authoritative guidance.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Parse Server is an open-source Node.js/Express application backend (the community successor to Facebook's Parse) that exposes a MongoDB/Postgres-style query API over REST and a real-time LiveQuery WebSocket channel. Parse queries support boolean composition through the $or, $and, and $nor operators, which the server recursively walks in an internal query-traversal helper. The root cause maps to CWE-407 (Inefficient Algorithmic Complexity): when these operators are deeply nested, the traversal exhibits exponential rather than linear time growth. Because Node.js is single-threaded with a cooperative event loop, this synchronous exponential work blocks the loop entirely, starving every other in-flight request and connection until it completes.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
REST/LiveQuery API is network-reachable and unauthenticated with a simple payload (AV:N/AC:L/PR:N/UI:N); impact is event-loop DoS only, so A:H with C:N/I:N.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.
Articles & Coverage 1
Executive ViewAI
Parse Server versions below 8.6.82 and 9.9.1-alpha.12 are vulnerable to an unauthenticated remote denial-of-service attack that can hang the backend and render services unavailable to all clients. A single crafted REST API request with deeply nested query operators exhausts CPU and event loop resources, requiring no credentials or prior access. Organizations running Parse Server face immediate risk of complete application outages if exposed to internet or untrusted networks.
Restrict Parse Server API access to known client IPs only; implement query depth validation rejecting requests with >3 nested logical operators; enforce aggressive request timeouts (≤5 seconds per query) at application and database levels; deploy per-IP rate limiting (100-200 req/min); add backend monitoring on event loop lag and CPU utilization to detect exploitation attempts; implement circuit breakers to fail gracefully if backend becomes unresponsive; validate and sanitize all incoming query structures.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB