https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-08T20:43:12.054823+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-parse-2026-32944 BIT-parse-2026-32944 — Parse Server crash via deeply nested query condition operators 2026-10-08T20:43:12.102862+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0 and 8.6.45, a depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/euvd-2026-276590 EUVD-2026-276590 2026-10-08T20:43:12.102923+00:00 EUVD-2026-276590 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32944 fkie_cve-2026-32944 2026-10-08T20:43:12.102939+00:00

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0-alpha.21 and 8.6.45, a depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available.

 https://cve.radiocsirt.org/vuln/ghsa-9xp9-j92r-p88v GHSA-9xp9-j92r-p88v — Parse Server crash via deeply nested query condition operators 2026-10-08T20:43:12.102966+00:00

Affected: npm: parse-server

### Impact

An unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients.

### Patches

A depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app.

### Workarounds

None.