VulnerabilityPublished 18 Mar 2026

CVE-2026-32944: parse-server · Uncontrolled Recursion

Affects parse-serverSource CVE Database V5

Compare

Not known to be exploited · CVSS 8.7 High : upgrade to 9.6.0-alpha.21 or 8.6.45 soon.

Data as of 31 Oct 2026, 20:20 UTC

CVSS 4.0 base score

8.7High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.5% chance of exploitation in 30 days – higher than 42% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 9.6.0-alpha.21, 8.6.45

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Attack Vector: Network
Attack Complexity: Low
Attack Requirements: None
Privileges Required: None
User Interaction: None
Vulnerable system confidentiality: None
Vulnerable system integrity: None
Vulnerable system availability: High
Subsequent system confidentiality: None
Subsequent system integrity: None
Subsequent system availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable system is bound to the network stack and the set of possible attackers extends beyond the other options listed below, up to and including the entire Internet. Such a vulnerability is often termed “remotely exploitable” and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: The attacker must take no measurable action to exploit the vulnerability. The attack requires no target-specific circumvention to exploit the vulnerability. An attacker can expect repeatable success against the vulnerable system.
Attack Requirements: None: The successful attack does not depend on the deployment and execution conditions of the vulnerable system. The attacker can expect to be able to reach the vulnerability and execute the exploit under all or most instances of the vulnerability.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files of the vulnerable system to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without interaction from any human user, other than the attacker.
Vulnerable system confidentiality: None: There is no loss of confidentiality within the Vulnerable System.
Vulnerable system integrity: None: There is no loss of integrity within the Vulnerable System.
Vulnerable system availability: High: There is a total loss of availability, resulting in the attacker being able to fully deny access to resources in the Vulnerable System; this loss is either sustained (while the attacker continues to deliver the attack) or persistent (the condition persists even after the attack has completed). Alternatively, the attacker has the ability to deny some availability, but the loss of availability presents a direct, serious consequence to the Vulnerable System (e.g., the attacker cannot disrupt existing connections, but can prevent new connections; the attacker can repeatedly exploit a vulnerability that, in each instance of a successful attack, leaks a only small amount of memory, but after repeated exploitation causes a service to become completely unavailable).
Subsequent system confidentiality: None: There is no loss of confidentiality within the Subsequent System or all confidentiality impact is constrained to the Vulnerable System.
Subsequent system integrity: None: There is no loss of integrity within the Subsequent System or all integrity impact is constrained to the Vulnerable System.
Subsequent system availability: None: There is no impact to availability within the Subsequent System or all availability impact is constrained to the Vulnerable System.

Definitions: FIRST CVSS v4.0 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 18 Mar 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 31 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade parse-server to 9.6.0-alpha.21 or 8.6.45; parse-server to 8.6.45.

Affected software

Product	Affected	Fixed in
parse-communityparse-server	Affected >=9.0.0 <9.6.0-alpha.21	Fixed in 9.6.0-alpha.21
parse-communityparse-server	Affected <8.6.45	Fixed in 8.6.45
npmparse-server`pkg:npm/parse-server`Other threats	Affected <8.6.45	Fixed in 8.6.45

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

To mitigate this vulnerability, organizations should immediately upgrade parse-server to version 9.6.0-alpha.21 or later, or 8.6.45 or later, where the fix is implemented. After upgrading, administrators must explicitly enable and configure the requestComplexity.queryDepth option to enforce a sensible maximum depth for query condition nesting based on their application's expected query complexity. This setting prevents maliciously crafted requests from triggering uncontrolled recursion. It is critical to test this configuration in staging environments to avoid breaking legitimate queries. Network-level protections such as Web Application Firewalls (WAFs) can be tuned to detect and block requests with suspiciously deep or complex query structures, providing an additional layer of defense. Monitoring and alerting on parse-server crashes or unusual request patterns can help detect exploitation attempts early. Since no workarounds exist, patching and configuration are the only effective defenses. Organizations should also review their incident response plans to handle potential DoS incidents and ensure rapid recovery.

Description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0 and 8.6.45, a depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your app. No known workarounds are available.

Impact

The primary impact of this vulnerability is a denial of service affecting availability. Organizations running vulnerable parse-server versions are at risk of having their backend services abruptly terminated by a single malicious request, causing downtime and disruption to all connected clients. This can lead to loss of business continuity, degraded user experience, and potential cascading failures in dependent systems. Since parse-server is often used in mobile and web application backends, the impact can extend to customer-facing services, potentially damaging reputation and trust. The ease of exploitation—no authentication or user interaction required—makes this vulnerability attractive for attackers aiming to disrupt services. While no known exploits are currently reported in the wild, the simplicity of the attack vector suggests that exploitation could emerge rapidly. Organizations with parse-server deployments in critical infrastructure or high-availability environments face increased operational risk. Additionally, repeated exploitation attempts could lead to resource exhaustion and increased operational costs due to recovery efforts.

Summary

Parse Server is an open-source backend framework that runs on Node.js and is widely used to build scalable applications. CVE-2026-32944 is a vulnerability classified under CWE-674 (Uncontrolled Recursion) affecting parse-server versions >= 9.0.0 and < 9.6.0-alpha.21, as well as versions below 8.6.45. The vulnerability arises because parse-server does not limit the depth of nested query condition operators in incoming requests. An attacker can craft a single malicious request with excessively deep nesting of query operators, causing the server to enter uncontrolled recursive processing. This recursion exhausts server resources, leading to a crash of the parse-server process and resulting in a denial of service (DoS) condition. The attack requires no authentication or user interaction, making it trivially exploitable remotely over the network. To address this, parse-server versions 9.6.0-alpha.21 and 8.6.45 introduced a new configuration option, requestComplexity.queryDepth, which enforces a maximum allowed depth for query nesting. However, this option is disabled by default to avoid breaking existing applications, so administrators must explicitly enable and configure it. No alternative workarounds are available, emphasizing the importance of upgrading and configuring the depth limit. The vulnerability has a CVSS 4.0 score of 8.7, indicating a high severity due to its network attack vector, lack of required privileges or user interaction, and its impact on availability.

CWE-674Uncontrolled Recursion (opens in a new tab)
Class weakness
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
Implementation
Ensure that an end condition will be reached under all logic conditions. The end condition may include checking against the depth of recursion and exiting with an error if the recursion goes too deep. The complexity of the end condition contributes to the effectiveness of this action.
Implementation
Increase the stack size.
Attack patterns
Serialized Data with Nested Payloads (opens in a new tab)
Oversized Serialized Data Payloads (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Mar 2026, 01:10 UTC

WeaknessesCWE-674

Technical details

References

Community reviews

Related threats