Executive brief
Parse Server's LiveQuery component is a real-time database subscription system used by applications to push live data updates to connected clients over WebSockets. An attacker can exploit a missing validation check by sending subscription requests with deeply nested queries, causing the server to consume excessive CPU resources through recursive processing. This can degrade or completely disable the service for legitimate users.
Technical details
Parse Server's LiveQuery WebSocket subscription handler fails to enforce the requestComplexity.queryDepth configuration limit, a validation that already protects REST API queries. An attacker can send a subscription request containing deeply nested logical operators (CWE-674: Uncontrolled Recursion) that trigger excessive recursion and CPU consumption. The vulnerability requires network access to the LiveQuery WebSocket endpoint with no authentication or user interaction; affected deployments are those with the endpoint reachable by untrusted clients. A successful exploit results in a denial of service condition. Fixes are available in Parse Server 8.6.56 and 9.6.0-alpha.45 or later, which add query depth validation to the LiveQuery subscription handler.
Affected products
- Parse Community Parse Server all versions before 8.6.56, and versions 9.0.0 before 9.6.0-alpha.45
Timeline
- 2026-03-20: disclosed
- 2026-03-20: patched: Parse Server 8.6.56 and 9.6.0-alpha.45 released