Loading story…
Parse Server disclosed and patched CVE-2026-57480, a denial-of-service flaw caused by exponential-time processing of deeply nested query operators in REST API and LiveQuery handling. An attacker can send crafted queries using logical operators such as $or, $and, and $nor to trigger excessive processing, block the Node.js event loop, and degrade availability. The issue affects versions earlier than 8.6.82 and 9.0.0-alpha.1 through before 9.9.1-alpha.12, and is tracked in GitHub advisories as GHSA-cgxm-vr2f-6fj8.
Parse Server maintainers fixed the bug by updating query validation and traversal logic so nested logical operators are detected even when buried under field-level operators such as $elemMatch and $not or under plain field names. The patches also enforce query-depth limits more consistently, reject malformed logical operators whose values are not arrays, and prevent repeated traversal patterns that could lead to O(2^n) behavior. The fixes were merged through pull request #10512, with releases available in 8.6.82 and 9.9.1-alpha.12, alongside tests confirming maliciously nested queries are rejected or handled in linear time rather than hanging the server.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
GitHub Security Advisories received the Parse Server denial-of-service vulnerability record for CVE-2026-57480. The issue describes how deeply nested $or, $and, and $nor operators can block the Node.js event loop and impact availability.
The vulnerability was fixed in Parse Server version 8.6.82 and version 9.9.1-alpha.12. The advisory identifies these releases as remediating the denial-of-service flaw affecting earlier versions.
A security fix for GHSA-cgxm-vr2f-6fj8 was merged into the parse-community parse-server release-8.x.x branch to address denial of service caused by exponential-time processing of deeply nested query operators. The changes updated REST query validation and LiveQuery handling, added malformed-operator checks, and included tests for maliciously nested queries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
6 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Parse Server disclosed two high-severity vulnerabilities affecting different attack paths in deployments running versions prior to recent fixes. **CVE-2026-33539** is a `CWE-89` SQL injection flaw in Parse Server environments that use the PostgreSQL adapter, where an attacker with **master key** access can inject SQL metacharacters through field-name parameters in the `aggregate` `$group` stage or the `distinct` operation. The issue can let a Parse Server application administrator escalate privileges to direct PostgreSQL database-level access. MongoDB-backed deployments are not affected, and fixes are available in versions **8.6.59** and **9.6.0-alpha.53**. A separate issue, **CVE-2026-33538**, allows an **unauthenticated denial-of-service** attack against Parse Server by sending authentication requests with arbitrary, unconfigured provider names. In affected versions before **8.6.58** and **9.6.0-alpha.52**, those requests trigger unindexed database queries that can force full collection scans on the user database; when parallelized, the traffic can exhaust database resources and degrade service availability. The flaw is classified as `CWE-400`, and both vulnerabilities were published through GitHub security advisories with patched releases available.
Jun 29, 2026
Multiple critical vulnerabilities in **JSONata** allow attackers to achieve arbitrary code execution in server-side Node.js applications that evaluate untrusted JSONata expressions. The issues, tracked as `CVE-2026-77413`, `CVE-2026-77414`, and `CVE-2026-77415`, stem from prototype pollution, unsafe property lookups, and object-integrity weaknesses that let crafted expressions reach inherited prototype members, manipulate internal function and lambda state, and ultimately invoke `process.getBuiltinModule` and `child_process`. The flaws are remotely exploitable without authentication or user interaction and can expose environment variables, configuration files, and database credentials while enabling persistence and lateral movement. Project maintainers shipped a series of hardening changes across the `1.x` and `2.x` branches, including blocking `$lookup` access to prototype members, replacing vulnerable objects with `Object.create(null)`, using safer `Object.prototype.hasOwnProperty.call` checks, preventing traversal into function-like objects, and rejecting reserved internal identifiers such as `_jsonata_lambda` and `_jsonata_function`. Affected versions include releases before `1.8.8` and `2.x` versions prior to `2.2.1`, with fixes delivered through `1.8.8`/`1.8.9`, `2.2.0`, and `2.2.1`; organizations using JSONata to process user-supplied expressions should prioritize upgrading and review exposed services for possible exploitation.
Aug 22, 2026
A high-severity denial-of-service flaw tracked as **`CVE-2026-71847`** was disclosed in the Ruby `json` package, affecting versions **`2.20.0` through before `2.21.2`**. The bug resides in the native C extension behind **`JSON::ResumableParser`**, where truncated streaming JSON containing duplicate object keys can cause the parser to clear its input buffer while leaving stale internal pointers behind, creating a **heap-use-after-free** condition classified as **`CWE-416`**. If an application accepts attacker-controlled JSON streams and later calls **`partial_value`** on the incomplete input, the parser can perform pointer operations on freed memory in its warning-handling path and crash the Ruby worker process. The issue impacts availability rather than confidentiality or integrity, and the fix in **`json` `2.21.2`** clears the freed buffer, nullifies parser state pointers, and adjusts warning generation logic to avoid cursor calculations when parser state is still present.
Aug 8, 2026