GHSA-mfj6-6p54-m98c
Suggest an improvement- Source
- https://github.com/advisories/GHSA-mfj6-6p54-m98c
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-mfj6-6p54-m98c/GHSA-mfj6-6p54-m98c.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-mfj6-6p54-m98c
- Aliases
- Published
- 2026-03-31T23:49:18Z
- Modified
- 2026-04-01T00:04:54.769174Z
- Severity
-
- 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- parse-server has GraphQL complexity validator exponential fragment traversal DoS
- Details
-
Impact
The GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the
requestComplexity.graphQLDepthorrequestComplexity.graphQLFieldsconfiguration options.Patches
The fix replaces the per-branch fragment traversal with memoized fragment computation, reducing the traversal from exponential O(2^N) to linear O(N) time. Additionally, early termination aborts the traversal as soon as configured limits are exceeded.
Workarounds
Disable GraphQL complexity limits by setting
requestComplexity.graphQLDepthandrequestComplexity.graphQLFieldsto-1(the default).Resources
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10344
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10345
- Database specific
{ "cwe_ids": [ "CWE-407" ], "github_reviewed": true, "nvd_published_at": "2026-03-31T16:16:33Z", "severity": "HIGH", "github_reviewed_at": "2026-03-31T23:49:18Z" }- References
-
- https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c
- https://nvd.nist.gov/vuln/detail/CVE-2026-34573
- https://github.com/parse-community/parse-server/pull/10344
- https://github.com/parse-community/parse-server/pull/10345
- https://github.com/parse-community/parse-server/commit/ea15412795f34594cc8a674fe858d445675e0295
- https://github.com/parse-community/parse-server/commit/f759bda075298ec44e2b4fb57659a0c56620483b
- https://github.com/parse-community/parse-server
Affected packages
npm / parse-server
Package
- Name
- parse-server
- View open source insights on deps.dev
- Purl
- pkg:npm/parse-server
npm / parse-server
Package
- Name
- parse-server
- View open source insights on deps.dev
- Purl
- pkg:npm/parse-server