CVE-2026-57480
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82,
CVSS
—
Sin CVSS
EPSS
0.3%
p26
KEV
—
Exploit Today
8
0-100
Publicado: 8 jul 2026 · Última mod.: 10 jul 2026 · CWE-407
0.3%EPSS · 30 días0.3%
2026-07-092026-07-21
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.9.1-alpha.12 and 8.6.82, deeply nested $or, $and, and $nor query condition operators in the REST API or LiveQuery query handling could trigger exponential-time processing in the internal query-traversal helper and block the Node.js event loop. This issue is fixed in versions 9.9.1-alpha.12 and 8.6.82.
- github.comhttps://github.com/parse-community/parse-server/commit/0f5d2ad77b422dc904458254548be87397fc6e9b
- github.comhttps://github.com/parse-community/parse-server/commit/1103c7a890e0455ba3dccd4bc5db17efe1789c9a
- github.comhttps://github.com/parse-community/parse-server/pull/10511
- github.comhttps://github.com/parse-community/parse-server/pull/10512
- github.comhttps://github.com/parse-community/parse-server/releases/tag/8.6.82
- github.comhttps://github.com/parse-community/parse-server/releases/tag/9.9.1-alpha.12
- github.comhttps://github.com/parse-community/parse-server/security/advisories/GHSA-cgxm-vr2f-6fj8
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-598857.5 ALT26.2%
——8pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4.3hCVE-2026-566697.5 ALT28.1%
——8Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation, and client-server communication. Prior to 1.4.29, Elysia uses getAll in form data normalization for multipart/form-data endpoints, causing the amount of work to grow quadratically with the number of unique key-value pairs and allowing CPU exhaustion. This issue is fixed in version 1.4.29.11dCVE-2026-55206—24.3%
——7py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo._read() in archiveinfo.py used an O(n^2) cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted .7z archive to cause excessive CPU consumption during SevenZipFile.init() before extraction. This issue is fixed in version 1.1.3.11dCVE-2026-599287.5 ALT28.9%
——9Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a Markdown document containing many repeated or distinct reference-link definitions causes quadratic work in src/mistune/block_parser.py and the ref_links environment dictionary handling, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.12dCVE-2026-599257.5 ALT28.2%
——8Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in src/mistune/inline_parser.py because the parser scans forward for matching close markers from every potential opening run, allowing denial of service in default Mistune parsing. This issue is fixed in version 3.3.0.12dCVE-2026-599227.5 ALT28.9%
——9Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0.12d