CVE-2026-34573 json
Parse Server: GraphQL complexity validator exponential fragment traversal DoS
published 2026-03-31 7 mo ago modified 2026-09-08 2 mo ago also BIT-parse-2026-34573 , EUVD-2026-17500 , GHSA-mfj6-6p54-m98c
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 51%
- public exploits
- 0
- none known
Summary
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0-alpha.12, the GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options. This issue has been patched in versions 8.6.68 and 9.7.0-alpha.12.
Patch / fix
- npm parse-server 8.6.68, 9.7.0-alpha.12
- bitnami parse 8.6.68, 9.7.0
- parseplatform parse-server 8.6.68, 9.7.0-alpha.12
- parseplatform parse_server 8.6.68, 9.7.0-alpha.12
- github.com/parse-community/parse-server@ea15412 commit
- github.com/parse-community/parse-server@f759bda commit
- github.com/parse-community/parse-server#10344 pull request
- github.com/parse-community/parse-server#10345 pull request
- github.com/parse-community/parse-server/security/advisories/GHSA-mfj6… advisory
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.64% chance of exploitation in the next 30 days, higher than 51% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.2 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | parse-server | >=9.0.0, <9.7.0-alpha.12 <8.6.68 |
9.7.0-alpha.12 8.6.68 |
| bitnami | parse | <8.6.68 >=9.0.0, <9.7.0 |
8.6.68 9.7.0 |
Affected products
- parse-community parse-server
Classification
- Weakness
-
- CWE-407 Inefficient Algorithmic Complexity
References
-
github.com
/parse-community/parse-server/pull/10344
web, issue-tracking, patch
-
github.com
/parse-community/parse-server/pull/10345
web, issue-tracking, patch
-
github.com
/parse-community/parse-server/commit/ea15412795f34594cc8a674fe858d445675e0295
web, patch
-
github.com
/parse-community/parse-server/commit/f759bda075298ec44e2b4fb57659a0c56620483b
web, patch
-
github.com
/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c
web, patch, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-34573
advisory, web
-
github.com
/parse-community/parse-server
package
Sources
- CVE List CVE-2026-34573
- GitHub Advisory GHSA-mfj6-6p54-m98c
- NVD CVE-2026-34573
- OSV BIT-parse-2026-34573
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.