Parse Server denial of service via nested query operators

Executive brief

Parse Server, an open-source backend framework, is vulnerable to a denial-of-service attack that can make the server completely unresponsive. By sending a specially crafted, small database query with deeply nested instructions, an attacker can force the server into a permanent loop of complex calculations. This blocks all other users from accessing the service and does not require any login credentials to execute.

Technical details

The vulnerability is classified as Inefficient Algorithmic Complexity (CWE-407) within the internal query-traversal helper of Parse Server. The root cause is a helper function that re-walks nested arrays for logical operators ($or, $and, $nor) with exponential time complexity, blocking the Node.js event loop. An unauthenticated remote attacker can trigger this by sending a small (~1 KB) query via the REST API or LiveQuery. While a 'queryDepth' limit exists, it could be bypassed by nesting operators inside field-level operators like $elemMatch. Patches in versions 8.6.82 and 9.9.1-alpha.12 implement linear-time traversal and generalized depth limiting.

Affected products

• Parse Community parse-server >= 9.0.0, < 9.9.1-alpha.12; < 8.6.82

Timeline

• 2026-06-17: disclosed
• 2026-06-19: advisory: GitHub Advisory published

References

• https://api.github.com/users/sajdakabir
• https://github.com/sajdakabir
• https://api.github.com/users/sajdakabir/gists%7B/gist_id%7D
• https://api.github.com/users/sajdakabir/repos
• https://avatars.githubusercontent.com/u/86569763?v=4
• https://api.github.com/users/sajdakabir/events%7B/privacy%7D