CVE-2026-33508: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33508 is a Denial of Service (DoS) vulnerability in Parse Server's LiveQuery component, classified as a LiveQuery subscription query depth bypass. The vulnerability allows unauthenticated remote attackers to send WebSocket subscription requests with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. Affected versions include all Parse Server releases prior to 8.6.56 and versions >= 9.0.0 prior to 9.6.0-alpha.45 for Node.js. The advisory was published on March 20, 2026, with patches released the same day. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.2 (High) (GitHub Advisory).

The root cause is CWE-674 (Uncontrolled Recursion): Parse Server's LiveQuery subscription handler in ParseLiveQueryServer._handleSubscribe failed to apply the requestComplexity.queryDepth configuration limit when processing WebSocket subscription requests, even though the same limit was enforced for REST API queries. An attacker can craft a subscription where clause with arbitrarily deeply nested logical operators ($or, $and, $nor), triggering unbounded recursive evaluation of the query condition tree. The fix adds pre-permission query depth validation to the LiveQuery subscription handler that recursively inspects the where clause for these patterns and rejects violations with INVALID_QUERY errors before any further processing occurs (GitHub Advisory, PR #10259, PR #10260).

Successful exploitation causes excessive CPU consumption on the Parse Server instance, leading to service degradation or complete denial of service for legitimate users. The vulnerability has no confidentiality or integrity impact — only availability is affected. Any deployment where the LiveQuery WebSocket endpoint is reachable by untrusted clients is at risk, which includes many public-facing Parse Server backends (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time. The vulnerability requires no authentication, no user interaction, and is exploitable over the network, making it trivially automatable against exposed LiveQuery WebSocket endpoints. The EPSS score is approximately 0.045% (0.000450), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Reconnaissance: Identify internet-facing Parse Server instances with LiveQuery enabled by scanning for open WebSocket endpoints (typically on port 1337 or behind a reverse proxy). Tools like Shodan or Censys can be used to locate exposed Parse Server deployments.
2. Establish WebSocket connection: Connect to the Parse Server LiveQuery WebSocket endpoint (e.g., ws://target:1337/), which accepts unauthenticated connections.
3. Craft malicious subscription: Construct a LiveQuery subscription message with a where clause containing deeply nested logical operators ($or, $and, or $nor), for example:

{
  "op": "subscribe",
  "requestId": 1,
  "query": {
    "className": "SomeClass",
    "where": {
      "$or": [{ "$or": [{ "$or": [{ "$or": [...] }] }] }]
    }
  }
}

4. Send subscription request: Transmit the crafted message over the WebSocket connection. The server's LiveQuery handler will recursively process the nested operators without enforcing the queryDepth limit.
5. Trigger DoS: The server enters excessive recursion, consuming CPU resources. Repeated or concurrent requests amplify the impact, potentially causing the service to become unresponsive for all users (GitHub Advisory, PR #10259).

• Network: Unusual volume of WebSocket connection attempts or subscription messages to the Parse Server LiveQuery endpoint; WebSocket frames containing deeply nested JSON structures with repeated $or, $and, or $nor keys.
• Logs: Parse Server logs showing repeated subscribe operations with complex where clauses; error logs indicating stack overflow or maximum call stack size exceeded errors originating from the LiveQuery subscription handler.
• Process: Sustained high CPU utilization by the Node.js Parse Server process without a corresponding increase in legitimate traffic; process becoming unresponsive or restarting due to resource exhaustion.

The parse-community has released patched versions that enforce requestComplexity.queryDepth limits in the LiveQuery subscription handler. Users should upgrade to Parse Server 8.6.56 (LTS) or Parse Server 9.6.0-alpha.45 (or later stable 9.6.0) immediately. There is no known workaround other than upgrading — the advisory explicitly states this. As additional defensive measures, operators should restrict network access to the LiveQuery WebSocket endpoint to trusted clients where possible, implement network-level rate limiting on WebSocket connections, and ensure requestComplexity.queryDepth is configured appropriately after patching (GitHub Advisory, PR #10260).