CVE-2026-33508CWE-674

Parse Server: LiveQuery subscription query depth bypass

High · published March 24, 2026

CVSS v4.0
8.2
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45.

The record
Technical detail
CVSS v4.0
8.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00644 · 50.2th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-03-24T18:21Z
EPSS history
Timeline
  • 24 MAR 18:21Z
    Parse Server: LiveQuery subscription query depth bypass
    cvelistv5