CyberRota Analysis
AI-GeneratedDeeply nested $or, $and, and $nor query operators in the Parse Server's REST API and LiveQuery handling can lead to exponential-time processing, potentially blocking the Node.js event loop and degrading application performance. Users of Parse Server versions prior to 9.9.1-alpha.12 and 8.6.82 should prioritize upgrading to mitigate this risk and ensure optimal functionality. This vulnerability is particularly relevant for developers and organizations utilizing Parse Server in their applications.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.