Which versions of Parse Server are affected by EUVD-2026-42421?

Parse Server versions below 8.6.82 and 9.9.1-alpha.12 are vulnerable to an unauthenticated remote denial-of-service attack that can hang the backend and render services unavailable to all clients.. A patch is available.

How to fix or mitigate EUVD-2026-42421?

Within 24 hours: Identify all Parse Server deployments, document versions, and isolate internet-facing instances behind network controls or restrict access to trusted clients only. Within 7 days: Implement query complexity validation (limit logical operator nesting to ≤3 levels), deploy per-IP rate limiting (100 requests/min), configure strict query timeouts (<5 seconds), and add WAF rules to block requests containing excessive nested $or/$and/$nor operators. Within 30 days: Monitor Parse Server project releases for security patches in 8.6.82 and 9.9.1-alpha.12 branches; test and deploy patches to affected systems as they become available.

Parse Server EUVD-2026-42421

Q: What is the CVSS score of EUVD-2026-42421?

EUVD-2026-42421 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-57480 HIGH

Inefficient Algorithmic Complexity (CWE-407)

2026-07-08 security-advisories@github.com

Information Disclosure Node.js

8.7

CVSS 4.0 · Vendor: github

Severity by source

Vendor (github) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

REST/LiveQuery API is network-reachable and unauthenticated with a simple payload (AV:N/AC:L/PR:N/UI:N); impact is event-loop DoS only, so A:H with C:N/I:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 08, 2026 - 22:04 EUVD

Analysis Generated

Jul 08, 2026 - 21:44 vuln.today

DescriptionCVE.org

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.

Articles & Coverage 1

News 5 New Node.js Vulnerabilities - 1 Critical, 4 High Severity Jul 09, 2026

AnalysisAI

Denial of service in Parse Server (versions prior to 8.6.82 and 9.9.1-alpha.12) allows remote attackers to hang the Node.js event loop by submitting deeply nested $or, $and, or $nor query operators through the REST API or LiveQuery interface, triggering exponential-time processing in the internal query-traversal helper. Because the vulnerable code path is reachable without authentication and consumes CPU without bound, a single crafted request can render the backend unresponsive to all clients. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

Parse Server is an open-source Node.js/Express application backend (the community successor to Facebook's Parse) that exposes a MongoDB/Postgres-style query API over REST and a real-time LiveQuery WebSocket channel. Parse queries support boolean composition through the $or, $and, and $nor operators, which the server recursively walks in an internal query-traversal helper. The root cause maps to CWE-407 (Inefficient Algorithmic Complexity): when these operators are deeply nested, the traversal exhibits exponential rather than linear time growth. Because Node.js is single-threaded with a cooperative event loop, this synchronous exponential work blocks the loop entirely, starving every other in-flight request and connection until it completes.

RemediationAI

Vendor-released patch: upgrade to Parse Server 8.6.82 (release: https://github.com/parse-community/parse-server/releases/tag/8.6.82) on the 8.x line, or to 9.9.1-alpha.12 (release: https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12) on the 9.x line; the fixes are in commits 0f5d2ad77b422dc904458254548be87397fc6e9b and 1103c7a890e0455ba3dccd4bc5db17efe1789c9a. Because 9.9.1-alpha.12 is a pre-release (alpha), production 9.x users should weigh stability trade-offs and consider staying on a patched 8.x build until a stable 9.x fix ships. If immediate patching is not possible, compensating controls include enforcing a maximum query-nesting depth or request-body size limit at a reverse proxy or WAF in front of Parse Server to reject deeply nested $or/$and/$nor structures (trade-off: may block legitimate complex queries), rate-limiting and requiring authentication on the REST and LiveQuery endpoints to reduce anonymous reachability, and restricting network exposure of the API to trusted clients. Consult the advisory at https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8 for authoritative guidance.