High severity · published Mar 31, 2026
CVE-2026-34573
Parse Server: GraphQL complexity validator exponential fragment traversal DoS
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0-alpha.12, the GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options. This issue has been patched in versions 8.6.68 and 9.7.0-alpha.12.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
parse-server · parse-community
< 8.6.68; >= 9.0.0, < 9.7.0-alpha.12 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-34573
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-34573
Patch
https://github.com/parse-community/parse-server/commit/ea15412795f34594cc8a674fe858d445675e0295
Patch
https://github.com/parse-community/parse-server/commit/f759bda075298ec44e2b4fb57659a0c56620483b
Issue Tracking
https://github.com/parse-community/parse-server/pull/10344
Issue Tracking
https://github.com/parse-community/parse-server/pull/10345
Patch
https://github.com/parse-community/parse-server/security/advisories/GHSA-mfj6-6p54-m98c
More from parse-server
10.0
CVE-2026-30966
Parse Server role escalation and CLP bypass via direct `_Join` table write
9.8
CVE-2026-32248
Parse Server: Account takeover via operator injection in authentication data identifier
9.8
CVE-2026-31871
Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
9.8
CVE-2026-31856
Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
9.8
CVE-2026-31840
Parse Server has a SQL injection via dot-notation field name in PostgreSQL