CVE-2026-33508
Last modified
CVE-2026-33508 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. EPSS estimates a 0.34% chance of exploitation in the next 30 days.
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Parseplatform | Parse-Server | < 8.6.56 | — |
| Parseplatform | Parse-Server | >= 9.0.0, < 9.6.0 | — |
| Parseplatform | Parse-Server | 9.6.0 | Alpha1 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-33508?
How severe is CVE-2026-33508?
How do I fix CVE-2026-33508?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-33502WWBN AVideo is an open source video platform. In versions up…8.2
- CVE-2026-33503Ory Kratos is an identity, user management and authenticatio…7.2
- CVE-2026-33504Ory Hydra is an OAuth 2.0 Server and OpenID Connect Provider…7.2
- CVE-2026-33505Ory Keto is am open source authorization server for managing…7.2
- CVE-2026-33506Ory Polis, formerly known as BoxyHQ Jackson, bridges or prox…8.8
- CVE-2026-33507WWBN AVideo is an open source video platform. In versions up…8.8
- CVE-2026-33509pyLoad is a free and open-source download manager written in…8.8
- CVE-2026-3351Improper authorization in the API endpoint GET /1.0/certific…4.3
- CVE-2026-33510Homarr is an open-source dashboard. Prior to 1.57.0, a DOM-b…8.8
- CVE-2026-33511pyLoad is a free and open-source download manager written in…9.8
- CVE-2026-33512WWBN AVideo is an open source video platform. In versions up…7.5
- CVE-2026-33513WWBN AVideo is an open source video platform. In versions up…7.5
Are you affected by CVE-2026-33508?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST