CVE-2026-34573
published 2026-03-31CVE-2026-34573: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0-alpha.12, the…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.46%
36.7th percentile
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0-alpha.12, the GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options. This issue has been patched in versions 8.6.68 and 9.7.0-alpha.12.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| parse-community | parse-server | < 8.6.68 | 8.6.68 |
| parse-community | parse-server | — | — |
| parse-community | parse-server | >= 0 < 8.6.68 | 8.6.68 |
| parse-community | parse-server | >= 9.0.0 < 9.7.0-alpha.12 | 9.7.0-alpha.12 |
| parseplatform | parse-server | < 8.6.68 | 8.6.68 |
| parseplatform | parse-server | — | — |
| parseplatform | parse-server | >= 9.0.0 < 9.7.0 | 9.7.0 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv4.08.2HIGHCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
parse-server has GraphQL complexity validator exponential fragment traversal DoS
ghsa·2026-03-31
CVE-2026-34573 [HIGH] CWE-407 parse-server has GraphQL complexity validator exponential fragment traversal DoS
parse-server has GraphQL complexity validator exponential fragment traversal DoS
### Impact
The GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the `requestComplexity.graphQLDepth` or `requestComplexity.graphQLFields` configuration options.
### Patches
The fix replaces the per-branch fragment traversal with memoized fragment computation, reducing the traversal from exponential O(2^N) to linear O(N) time. Additionally, early termination aborts the traversal as soon as configured limits are exceeded.
### Workarounds
Disable
OSV
parse-server has GraphQL complexity validator exponential fragment traversal DoS
osv·2026-03-31
CVE-2026-34573 [HIGH] parse-server has GraphQL complexity validator exponential fragment traversal DoS
parse-server has GraphQL complexity validator exponential fragment traversal DoS
### Impact
The GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the `requestComplexity.graphQLDepth` or `requestComplexity.graphQLFields` configuration options.
### Patches
The fix replaces the per-branch fragment traversal with memoized fragment computation, reducing the traversal from exponential O(2^N) to linear O(N) time. Additionally, early termination aborts the traversal as soon as configured limits are exceeded.
### Workarounds
Disable
No detection rules found.
No public exploits indexed.
https://github.com/parse-community/parse-server/commit/ea15412795f34594cc8a674fe858d445675e0295https://github.com/parse-community/parse-server/commit/f759bda075298ec44e2b4fb57659a0c56620483bhttps://github.com/parse-community/parse-server/pull/10344https://github.com/parse-community/parse-server/pull/10345https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c
2026-03-31
Published