Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
NVD Vulnerability Details :
CVE-2026-34573
Analyzed
More InfoOfficial Page
Source-security-advisories@github.com
View Known Exploited Vulnerability (KEV) details
Published At-31 Mar, 2026 | 16:16
Updated At-24 Jul, 2026 | 20:10

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0-alpha.12, the GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options. This issue has been patched in versions 8.6.68 and 9.7.0-alpha.12.

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.08.2HIGH
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
N/A
Type: Secondary
Version: 4.0
Base score: 8.2
Base severity: HIGH
Vector:
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Primary
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Type: N/A
Version:
Base score:
Base severity: N/A
Vector:
CPE Matches
parseplatform
parseplatform
>>parse-server>>Versions before 8.6.68(exclusive)
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>Versions from 9.0.0(inclusive) to 9.7.0(exclusive)
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha1:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha10:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha11:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha2:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha3:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha4:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha5:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha6:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha7:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha8:*:*:*:node.js:*:*
parseplatform
parseplatform
>>parse-server>>9.7.0
cpe:2.3:a:parseplatform:parse-server:9.7.0:alpha9:*:*:*:node.js:*:*
Weaknesses
CWE IDTypeSource
CWE-407Secondarysecurity-advisories@github.com
CWE ID: CWE-407
Type: Secondary
Source: security-advisories@github.com
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://github.com/parse-community/parse-server/commit/ea15412795f34594cc8a674fe858d445675e0295security-advisories@github.com
Patch
https://github.com/parse-community/parse-server/commit/f759bda075298ec44e2b4fb57659a0c56620483bsecurity-advisories@github.com
Patch
https://github.com/parse-community/parse-server/pull/10344security-advisories@github.com
Issue Tracking
Patch
https://github.com/parse-community/parse-server/pull/10345security-advisories@github.com
Issue Tracking
Patch
https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98csecurity-advisories@github.com
Patch
Vendor Advisory
Hyperlink: https://github.com/parse-community/parse-server/commit/ea15412795f34594cc8a674fe858d445675e0295
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/parse-community/parse-server/commit/f759bda075298ec44e2b4fb57659a0c56620483b
Source: security-advisories@github.com
Resource:
Patch
Hyperlink: https://github.com/parse-community/parse-server/pull/10344
Source: security-advisories@github.com
Resource:
Issue Tracking
Patch
Hyperlink: https://github.com/parse-community/parse-server/pull/10345
Source: security-advisories@github.com
Resource:
Issue Tracking
Patch
Hyperlink: https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c
Source: security-advisories@github.com
Resource:
Patch
Vendor Advisory
Change History
0Changes found
Details not found