Parse Server Denial-of-Service Vulnerability via Deeply Nested Query Operators

A denial-of-service vulnerability has been identified in Parse Server versions 9.0.0 prior to 9.6.0-alpha.21 and in versions prior to 8.6.45. The issue allows an unauthenticated attacker to crash the Parse Server process by sending a request with deeply nested query condition operators. This action terminates the server process, causing a service disruption for all connected clients.

Impact

Exploitation of this vulnerability leads to a server crash, causing a denial-of-service condition for all connected clients.

Remediation

To address this vulnerability, users should upgrade to Parse Server versions 9.6.0-alpha.21 or 8.6.45. After upgrading, the `requestComplexity.queryDepth` server option should be enabled and set to a value appropriate for the application.