Executive brief
Parse Server is an open-source backend framework used to build and host applications. A vulnerability in its GraphQL component allows an attacker to crash or freeze the service by sending a specially crafted request. This can lead to a total service outage for all users, even if the attacker is not logged in.
Technical details
An algorithmic complexity vulnerability (CWE-407) exists in the GraphQL query complexity validator of Parse Server. The root cause is an exponential O(2^N) fragment traversal during the validation of GraphQL queries containing binary fan-out fragment spreads. An unauthenticated remote attacker can exploit this by sending a crafted GraphQL query, which blocks the Node.js event loop for several seconds, leading to a denial-of-service (DoS). This issue specifically affects deployments where 'requestComplexity.graphQLDepth' or 'requestComplexity.graphQLFields' are enabled. The vulnerability is patched in versions 8.6.68 and 9.7.0-alpha.12 by implementing memoized fragment computation and early termination.
Affected products
- Parse Community Parse Server < 8.6.68, >= 9.0.0 < 9.7.0-alpha.12
Timeline
- 2026-03-29: advisory: Vendor advisory GHSA-mfj6-6p54-m98c published
- 2026-03-31: disclosed: CVE-2026-34573 published to NVD
References
- https://github.com/parse-community/parse-server/commit/ea15412795f34594cc8a674fe858d445675e0295
- https://github.com/parse-community/parse-server/commit/f759bda075298ec44e2b4fb57659a0c56620483b
- https://github.com/parse-community/parse-server/pull/10344
- https://github.com/parse-community/parse-server/pull/10345
- https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c