https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T01:23:15.956416+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-parse-2026-33508 BIT-parse-2026-33508 — Parse Server: LiveQuery subscription query depth bypass 2026-10-09T01:23:16.008204+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0

 https://cve.radiocsirt.org/vuln/euvd-2026-277421 EUVD-2026-277421 2026-10-09T01:23:16.008268+00:00 EUVD-2026-277421 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33508 fkie_cve-2026-33508 2026-10-09T01:23:16.008285+00:00

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45.

 https://cve.radiocsirt.org/vuln/ghsa-6qh5-m6g3-xhq6 GHSA-6qh5-m6g3-xhq6 — Parse Server LiveQuery subscription query depth bypass 2026-10-09T01:23:16.008312+00:00

Affected: npm: parse-server

### Impact

Parse Server's LiveQuery component does not enforce the `requestComplexity.queryDepth` configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.

Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.

### Patches

The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same `requestComplexity.queryDepth` limit that already protects REST API queries.

### Workarounds

There is no known workaround other than upgrading.