GHSA-6qh5-m6g3-xhq6

Source

https://github.com/advisories/GHSA-6qh5-m6g3-xhq6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6qh5-m6g3-xhq6/GHSA-6qh5-m6g3-xhq6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-6qh5-m6g3-xhq6

Aliases

Published

2026-03-20T21:48:17Z

Modified

2026-03-30T14:05:50.544408Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

Parse Server LiveQuery subscription query depth bypass

Details

Impact

Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability.

Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients.

Patches

The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same requestComplexity.queryDepth limit that already protects REST API queries.

Workarounds

There is no known workaround other than upgrading.

Database specific

{
    "severity": "HIGH",
    "cwe_ids": [
        "CWE-674"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-20T21:48:17Z",
    "nvd_published_at": "2026-03-24T19:16:54Z"
}

References

Affected packages

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

9.0.0

Fixed

9.6.0-alpha.45

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6qh5-m6g3-xhq6/GHSA-6qh5-m6g3-xhq6.json"

npm / parse-server

Package

Name: parse-server; View open source insights on deps.dev
Purl: pkg:npm/parse-server

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8.6.56

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-6qh5-m6g3-xhq6/GHSA-6qh5-m6g3-xhq6.json"