CVE-2026-32944

npm/parse-server CVE-2026-32944: high, EPSS 0.63%

Parse Server crash via deeply nested query condition operators

Action: Upgrade parse-server to 8.6.45 or later.

npm i parse-server@9.6.0-alpha.21

npm i parse-server@8.6.45

Affected

Fixed versions

Sources

• osv: GHSA-9xp9-j92r-p88v
• https://github.com/parse-community/parse-server/security/advisories/GHSA-9xp9-j92r-p88v
• https://nvd.nist.gov/vuln/detail/CVE-2026-32944
• https://github.com/parse-community/parse-server/pull/10202
• https://github.com/parse-community/parse-server/pull/10203
• https://github.com/parse-community/parse-server

CVE-2026-32944 · published 2026-03-17T17:35:52Z · modified 2026-03-20T12:26:14.750267Z · JSON