CVE-2026-57480
NoneCVSS
—
EPSS
—
Published
Jul 8, 2026
CISA due date
—
The record
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-19630 In a BIND resolver, inbound DNS protocol messages with a particular structure will result… CWE-407
- CVE-2026-112894 Pillow is a Python imaging library. CWE-407
- CVE-2026-112891 Pillow is a Python imaging library. CWE-407
- CVE-2026-112401 Pillow is a Python imaging library. CWE-407
- CVE-2026-111766 markdown-it is a Markdown parser. CWE-407
- CVE-2026-111759 markdown-it is a Markdown parser. CWE-407
- CVE-2026-95838 containerd is an open-source container runtime. CWE-407
- CVE-2026-104844 PostCSS Selector Parser is a CSS selector parser that integrates with PostCSS but does… CWE-407