PT-2026-29277 · Unknown · Parse Server

Bugbunny-Research · CVE-2026-34573 · Publicado 2026-03-31 · Atualizado 2026-04-06

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.68 Parse Server versions prior to 9.7.0-alpha.12

Description Parse Server, an open-source backend deployable on Node.js infrastructures, is susceptible to a denial-of-service condition. A crafted GraphQL query utilizing binary fan-out fragment spreads can exploit the GraphQL query complexity validator, potentially blocking the Node.js event loop for several seconds and disrupting service for all concurrent users. This issue only impacts deployments where the requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options are enabled. The fix involves replacing the per-branch fragment traversal with memoized fragment computation, reducing the traversal time from exponential to linear.

Recommendations Update Parse Server to version 8.6.68 or later. Update Parse Server to version 9.7.0-alpha.12 or later. As a workaround, disable GraphQL complexity limits by setting requestComplexity.graphQLDepth and requestComplexity.graphQLFields to -1.

Exploit

Correção

Enumeração de Fraquezas

CWE-407

Identificadores relacionados

BIT-PARSE-2026-34573

CVE-2026-34573

GHSA-MFJ6-6P54-M98C

Produtos afetados

Parse Server

Referências · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34573.json · Exploit
• https://github.com/parse-community/parse-server · Nota
• https://github.com/parse-community/parse-server/pull/10345 · Correção
• https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c · Aviso do Fabricante
• https://github.com/parse-community/parse-server/commit/f759bda075298ec44e2b4fb57659a0c56620483b · Correção
• https://github.com/parse-community/parse-server/commit/ea15412795f34594cc8a674fe858d445675e0295 · Correção
• https://github.com/parse-community/parse-server/pull/10344 · Correção
• https://osv.dev/vulnerability/GHSA-mfj6-6p54-m98c · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-parse-2026-34573 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-34573 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-34573 · Nota de Segurança