CVE-2026-32944: 
JavaScript vulnerability analysis and mitigation

CVE-2026-32944 is a Denial of Service vulnerability in Parse Server, an open source Node.js backend platform, caused by uncontrolled recursion when processing deeply nested query condition operators. An unauthenticated remote attacker can crash the Parse Server process by sending a single crafted request, terminating the server and denying service to all connected clients. The vulnerability affects all Parse Server versions prior to 8.6.45 (8.x branch) and versions 9.0.0 through 9.6.0-alpha.20 (9.x branch). It was published on March 18, 2026, with patches released on March 15, 2026. The CVSS v3.1 base score is 7.5 (High), and the CVSS v4.0 base score is 8.7 (High) (GitHub Advisory, Feedly).

The root cause is CWE-674 (Uncontrolled Recursion): Parse Server's DatabaseController.validateQuery function recursively processes logical query operators ($or, $and, $nor) without enforcing any depth limit, allowing an attacker to trigger a stack overflow by submitting a query with arbitrarily deep nesting of these operators. The attack vector is network-based, requires no authentication, no privileges, and no user interaction — a single HTTP request with a deeply nested query payload is sufficient to crash the Node.js process. The fix introduces a configurable requestComplexity.queryDepth server option that tracks and enforces a maximum nesting depth during query validation, with master and maintenance keys able to bypass the limit (GitHub Advisory, Fix PR #10202).

Successful exploitation causes the Parse Server Node.js process to crash entirely, resulting in complete loss of availability for all connected clients and any applications depending on the backend. There is no impact on confidentiality or data integrity — the attack is purely a denial of service. Because a single unauthenticated request is sufficient to bring down the server, the attack can be repeated trivially to prevent service recovery, making it particularly disruptive for production deployments (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation as of the time of publication (Feedly). The EPSS score is approximately 0.046%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the low attack complexity and lack of authentication requirements make it straightforward for any attacker to exploit once the attack pattern is understood.

1. Reconnaissance: Identify internet-facing Parse Server instances (any version prior to 8.6.45 or 9.6.0-alpha.21) using tools like Shodan or Censys, or by probing known Parse Server API endpoints (e.g., /parse/classes/).
2. Craft malicious payload: Construct an HTTP request containing a query with deeply nested logical operators ($or, $and, or $nor). For example, build a JSON body where each level wraps the next in another $or array, repeated hundreds or thousands of times to exceed the Node.js call stack limit.
3. Send the request: Submit the crafted request to any Parse Server query endpoint (e.g., GET /parse/classes/<ClassName>?where=<deeply_nested_json> or via a POST request) without any authentication headers.
4. Trigger crash: The server's validateQuery function recursively processes each nesting level without a depth check, causing a stack overflow that terminates the Node.js process and denies service to all connected clients (GitHub Advisory, Fix PR #10202).

• Network: Unusual HTTP requests to Parse Server query endpoints (e.g., /parse/classes/*) containing abnormally large or deeply nested JSON where parameters with repeated $or, $and, or $nor keys.
• Logs: Sudden absence of Parse Server log output following a request; Node.js process crash logs or unhandled exception stack traces referencing validateQuery or DatabaseController; process manager (e.g., PM2, systemd) logs showing unexpected Parse Server restarts.
• Process: Parse Server Node.js process terminating unexpectedly; process manager automatically restarting the service; elevated CPU usage immediately before crash due to deep recursion.

Upgrade Parse Server to version 8.6.45 (for 8.x deployments) or 9.6.0-alpha.21 or later (for 9.x deployments, with stable 9.6.0 also available) to receive the fix (Fix PR #10202, Fix PR #10203). After upgrading, explicitly configure the requestComplexity.queryDepth server option to an appropriate positive integer value for your application — this option is disabled by default (-1) to avoid breaking changes and must be set manually to enforce the depth limit. No configuration-based workarounds are available for unpatched versions; upgrading is the only remediation (GitHub Advisory).

The vulnerability was disclosed by Parse Server maintainer mtrezza via a GitHub Security Advisory on March 16–18, 2026, with patches already merged before public disclosure (GitHub Advisory). RedPacketSecurity noted the vulnerability on social media shortly after disclosure. The advisory was also tracked by ENISA's European Vulnerability Database (EUVD-2026-12992) and picked up by several vulnerability aggregators. No major independent security researcher commentary or media coverage beyond standard vulnerability tracking has been identified.