What is the CVSS score of EUVD-2026-12992?

EUVD-2026-12992 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate EUVD-2026-12992?

Within 24 hours: Identify all Parse Server instances and confirm versions against the affected range (before 8.6.45 and 9.0.0-9.6.0-alpha.21). Within 7 days: Apply vendor patches to all affected systems, beginning with production environments. Within 30 days: Complete patching across all non-production environments and validate remediation through testing.

EUVD-2026-12992

| CVE-2026-32944 HIGH

Uncontrolled Recursion (CWE-674)

2026-03-17 https://github.com/parse-community/parse-server

GHSA-9xp9-j92r-p88v

Denial Of Service

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Lifecycle Timeline

EUVD ID Assigned

Mar 18, 2026 - 21:45 euvd

EUVD-2026-12992

Analysis Generated

Mar 18, 2026 - 21:45 vuln.today

Patch released

Mar 18, 2026 - 21:45 nvd

Patch available

CVE Published

Mar 17, 2026 - 17:35 nvd

HIGH 8.7

DescriptionGitHub Advisory

Impact

An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.

Patches

A depth limit for query condition operator nesting has been added via the requestComplexity.queryDepth server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.

Workarounds

None.

AnalysisAI

Parse Server contains a vulnerability that allows an unauthenticated remote attacker to crash the server process through a single HTTP request containing deeply nested query condition operators. This denial of service vulnerability affects parse-server versions before 8.6.45 and alpha versions 9.0.0 through 9.6.0-alpha.21. The vulnerability is classified as high severity with a CVSS score of 8.7, and patches are available from the vendor.

Technical ContextAI

Parse Server is an open-source backend framework delivered as an npm package (pkg:npm/parse-server) commonly used for mobile and web applications. The vulnerability stems from CWE-674 (Uncontrolled Recursion), where the server fails to limit the depth of nested query condition operators in incoming requests. When processing deeply nested query structures, the Parse Server process encounters stack exhaustion or excessive resource consumption, leading to a crash. The vendor has introduced a new server configuration option 'requestComplexity.queryDepth' to enforce depth limits on query operator nesting, addressing the root cause of unbounded recursion during query parsing.

RemediationAI

Upgrade Parse Server to version 8.6.45 or later for the stable branch, or version 9.6.0-alpha.21 or later for users on the alpha track, as detailed in GitHub security advisory https://github.com/parse-community/parse-server/security/advisories/GHSA-9xp9-j92r-p88v. After upgrading, configure the new 'requestComplexity.queryDepth' server option to an appropriate value for your application to enforce query nesting depth limits (this option is disabled by default to maintain backward compatibility). Patches are available via GitHub pull requests 10202 and 10203 at https://github.com/parse-community/parse-server/pull/10202 and https://github.com/parse-community/parse-server/pull/10203. No workarounds are available for unpatched systems, making immediate upgrade essential for production environments.