Parse Server: Query condition depth bypass via pre-validation transform pipeline
概要
Parse Server: Query condition depth bypass via pre-validation transform pipeline
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.55 and 9.6.0-alpha.44, an attacker can send an unauthenticated HTTP request with a deeply nested query containing logical operators to permanently hang the Parse Server process. The server becomes completely unresponsive and must be manually restarted. This is a bypass of the fix for CVE-2026-32944. This issue has been patched in versions 8.6.55 and 9.6.0-alpha.44.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
参照URL
- advisory github.com
- advisory nvd.nist.gov
- advisory github.com
- patch github.com
- patch github.com
- patch github.com
- patch github.com