GHSA-6qh5-m6g3-xhq6
Parse Server LiveQuery subscription query depth bypass
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | parse-server | >= 9.0.0, < 9.6.0-alpha.45 | 9.6.0-alpha.45 |
| npm | parse-server | < 8.6.56 | 8.6.56 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
Parse Server's LiveQuery component does not enforce the `requestComplexity.queryDepth` configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.
Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.
### Patches
The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same `requestComplexity.queryDepth` limit that already protects REST API queries.
### Workarounds
There is no known workaround other than upgrading.
References
External links from the advisory. They lead to third-party sites.
- https://github.com/parse-community/parse-server/security/advisories/GHSA-6qh5-m6g3-xhq6
- https://nvd.nist.gov/vuln/detail/CVE-2026-33508
- https://github.com/parse-community/parse-server/pull/10259
- https://github.com/parse-community/parse-server/pull/10260
- https://github.com/parse-community/parse-server/commit/060d27053fb0fadf613c25aabab7fe0c82b7a899
- https://github.com/parse-community/parse-server/commit/2126fe4e12f9b399dc6b4b6a3fa70cb1825f159b
- https://github.com/parse-community/parse-server