{"id":"EUVD-2026-42421","enisaUuid":"50bd3818-1b43-367a-997e-88827a458f8c","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.","datePublished":"Jul 8, 2026, 8:53:21 PM","dateUpdated":"Jul 9, 2026, 1:43:23 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8\nhttps://github.com/parse-community/parse-server/pull/10511\nhttps://github.com/parse-community/parse-server/pull/10512\nhttps://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9b\nhttps://github.com/parse-community/parse-server/commit/1103c7a890e0455ba3dccd4bc5db17efe1789c9a\nhttps://github.com/parse-community/parse-server/releases/tag/8.6.82\nhttps://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12\n","aliases":"CVE-2026-57480\n","assigner":"GitHub_M","epss":0.59,"enisaIdProduct":[{"id":"c9c3a71c-1d26-3dc1-b400-b19e25629ea6","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0-alpha.1, \u003c 9.9.1-alpha.12"},{"id":"edf0c2e5-811f-309d-b84d-542c03d55ae1","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.82"}],"enisaIdVendor":[{"id":"88394360-1099-31df-bca9-3e6aa2b26b5f","vendor":{"name":"parse-community"}}],"enisaIdVulnerability":[{"id":"eecda06c-4c07-3f37-aa82-ddfe02eea2e5","vulnerability":{"id":"CVE-2026-57480","description":"Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.","datePublished":"Jul 8, 2026, 8:53:21 PM","dateUpdated":"Jul 9, 2026, 1:43:23 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","references":"https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8\nhttps://github.com/parse-community/parse-server/pull/10511\nhttps://github.com/parse-community/parse-server/pull/10512\nhttps://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9b\nhttps://github.com/parse-community/parse-server/commit/1103c7a890e0455ba3dccd4bc5db17efe1789c9a\nhttps://github.com/parse-community/parse-server/releases/tag/8.6.82\nhttps://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12\n","enisa_id":"EUVD-2026-42421\n","assigner":"GitHub_M","epss":0.59,"dataProcessed":"Nov 7, 2026, 7:20:40 AM","vulnerabilityProduct":[{"id":"4d5e75f0-d93d-3821-a258-a684ae5b1b9e","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"\u003c 8.6.82"},{"id":"d6424b7e-9f65-3530-8374-82a4f394a1f1","product":{"name":"parse-server","vendor":{"name":"parse-community"}},"product_version":"9.0.0-alpha.1, \u003c 9.9.1-alpha.12"}],"vulnerabilityVendor":[{"id":"e8cec850-b7e9-3df6-b75f-ca4a759412cf","vendor":{"name":"parse-community"}}]}}],"enisaIdAdvisory":[]}