CVE-2026-57480 - CVSS, EPSS & CISA Kev 상세 정보 | CVE Find

CVE 설명

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.

CVE 정보

관련 약점

CWE-ID	약점 이름	출처
CWE-407	Inefficient Algorithmic Complexity An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.

참고 자료

https://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9b

https://github.com/parse-community/parse-server/commit/1103c7a890e0455ba3dccd4bc5db17efe1789c9a

https://github.com/parse-community/parse-server/pull/10511

https://github.com/parse-community/parse-server/pull/10512

https://github.com/parse-community/parse-server/releases/tag/8.6.82

https://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12

https://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8