Vulnerability record · CVE-2026-57480 · published 8 July 2026

CVE-2026-57480: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.

8.7 CVSS 4.0 High EPSS 0.59% · top 54.0% CWE-407 · CWE-407 Deferred

8.7CVSS 4.0 base score

0.59%EPSS exploitation probability, 30 days

NoNot in CISA KEV

0Affected product versions listed by NVD

7References

10 Jul 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

References

Link	Tags
https://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9b
https://github.com/parse-community/parse-server/commit/1103c7a890e0455ba3dccd4bc5db17efe1789c9a
https://github.com/parse-community/parse-server/pull/10511
https://github.com/parse-community/parse-server/pull/10512
https://github.com/parse-community/parse-server/releases/tag/8.6.82
https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12
https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8

Track CVE-2026-57480 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Source: NIST National Vulnerability Database (record CVE-2026-57480), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.