CVE-2026-33498

npm/parse-server CVE-2026-33498: high 7.5

Parse Server has a query condition depth bypass via pre-validation transform pipeline

Action: Upgrade parse-server to 8.6.55 or later.

npm i parse-server@9.6.0-alpha.44

npm i parse-server@8.6.55

Affected

Fixed versions

Sources

• osv: GHSA-9fjp-q3c4-6w3j
• https://github.com/parse-community/parse-server/security/advisories/GHSA-9fjp-q3c4-6w3j
• https://nvd.nist.gov/vuln/detail/CVE-2026-33498
• https://github.com/parse-community/parse-server/pull/10257
• https://github.com/parse-community/parse-server/pull/10258
• https://github.com/parse-community/parse-server/commit/2581b5426047ce9cbcd3d9c0e8379e9c30e23ab5
• https://github.com/parse-community/parse-server/commit/85994eff9e7b34cac7e1a2f5791985022a1461d1
• https://github.com/parse-community/parse-server

CVE-2026-33498 · published 2026-03-20T20:56:22Z · modified 2026-03-30T14:04:50.929318Z · JSON