Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2026-33498

22
FAUCET Score

CVE-2026-33498 is a high-severity denial-of-service vulnerability in Parse Server, affecting versions prior to 8.6.55 and 9.6.0-alpha.44. An unauthenticated attacker can exploit this by sending a deeply nested query, causing the server process to permanently hang and require a manual restart. Rated 7.5 CVSS (High), the attack vector is network-based with low complexity, leading to a complete loss of availability. This issue bypasses a previous fix (CVE-2026-32944). There is currently no evidence of active exploitation, public exploit code, or significant community attention for this vulnerability.

Impacted Technologies

VendorProductVersion(s)CPE
< 8.6.55CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
>= 9.0.0, < 9.6.0CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
9.6.0CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha1:*:*:*:node.js:*:*
9.6.0CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha10:*:*:*:node.js:*:*
9.6.0CPE matchmatch criteria
cpe:2.3:a:parseplatform:parse-server:9.6.0:alpha11:*:*:*:node.js:*:*

CVSS Data

CVSS version used by this source: 4.0

8.7HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
VS Confidentiality
NONE
VS Integrity
NONE
VS Availability
HIGH
SS Confidentiality
NONE
SS Integrity
NONE
SS Availability
NONE
Exploit Maturity
NOT_DEFINED
CvssVersion
4.0

Exploit Intelligence

EPSS Score
0.45%
Probability of exploitation in next 30 days
EPSS Percentile
37.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0045 is in the 16th percentile among its peer group of 51,553 CVEs.

Social Chatter

No social media mentions found for this CVE.

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

github_advisorypatch availablevia nvd_reference
View patch
npmpatch availablevia ghsa
Product: parse-serverFixed in: 9.6.0-alpha.44
npmpatch availablevia ghsa
Product: parse-serverFixed in: 8.6.55

Vendor Advisories (1)

npmGHSA-9fjp-q3c4-6w3jhigh

Parse Server has a query condition depth bypass via pre-validation transform pipeline

Mar 20, 2026

References

github.com / parse-community/parse-server/commit/2581b5426047ce9cbcd3d9c0e8379e9c30e23ab5
Patch
github.com / parse-community/parse-server/commit/85994eff9e7b34cac7e1a2f5791985022a1461d1
Patch
github.com / parse-community/parse-server/pull/10257
Issue Tracking
github.com / parse-community/parse-server/pull/10258
Issue Tracking
github.com / parse-community/parse-server/security/advisories/GHSA-9fjp-q3c4-6w3j
Vendor Advisory