8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-34573

CVE-2026-34573: Parse Server: GraphQL complexity validator exponential fragment traversal DoS

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0-alpha.12, the GraphQL query complexity validator can be exploited to cause a denial-of-service by sending a crafted query with binary fan-out fragment spreads. A single unauthenticated request can block the Node.js event loop for seconds, denying service to all concurrent users. This only affects deployments that have enabled the requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options. This issue has been patched in versions 8.6.68 and 9.7.0-alpha.12.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-34573

CVE-2026-34573:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.7.0-alpha.12	9.7.0-alpha.12
parse-server	npm	< 8.6.68	8.6.68

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the calculateQueryComplexity function in src/GraphQL/helpers/queryComplexity.js. This function is responsible for calculating the complexity of GraphQL queries to prevent resource exhaustion. The core of the vulnerability is an inefficient algorithm for handling GraphQL fragments. Specifically, the nested visitSelectionSet function recursively processed fragment spreads. In the vulnerable version, it did so without memoization, meaning that if a fragment was spread multiple times, its complexity would be recalculated each time. This allowed an attacker to craft a query with a 'binary fan-out' of fragment spreads, where each fragment references two others. This structure leads to an exponential growth in the number of traversal steps, causing the Node.js event loop to block for a significant amount of time and resulting in a Denial of Service (DoS). The provided patches fix this by introducing a cache (fragmentCache) to memoize the complexity of each fragment. This ensures that each fragment's complexity is calculated only once, changing the algorithm's time complexity from exponential to linear and preventing the DoS. The createComplexityValidationPlugin function is the entry point that triggers this validation and would be present in any stack trace related to the exploit.

Vulnerable functions

calculateQueryComplexity

src/GraphQL/helpers/queryComplexity.js

The `calculateQueryComplexity` function, and specifically its nested `visitSelectionSet` function, was vulnerable to a denial-of-service attack. When processing a GraphQL query with fragment spreads, the function would recursively traverse each fragment. For a crafted query with a binary fan-out structure (where each fragment spreads two other fragments), this resulted in an exponential O(2^N) traversal of the query's fragments. This exponential complexity could be triggered by a single unauthenticated request, causing the Node.js event loop to hang for an extended period, thus denying service to all other users. The patch mitigates this by introducing memoization (caching) for fragment computations, reducing the complexity from exponential to linear O(N).

createComplexityValidationPlugin

src/GraphQL/helpers/queryComplexity.js

This function serves as the entry point for the vulnerable logic. It creates an Apollo Server plugin that, for each request, calls `calculateQueryComplexity` to determine if the query's complexity is within the configured limits. An exploit would necessarily pass through this function to trigger the expensive computation in `calculateQueryComplexity`. Therefore, `createComplexityValidationPlugin` would appear in a runtime profile or stack trace during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.