[parse-server] Parse Server LiveQuery subscription query depth bypass

**[parse-server] Parse Server LiveQuery subscription query depth bypass**

Impact Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. Deployments are affected when the LiveQuery WebSocket endpoint is reachable by untrusted clients. Patches The fix adds query condition depth validation to the LiveQuery subscription handler, enforcing the same requestComplexity.queryDepth limit that already protects REST API queries. Workarounds There is no known workaround other than upgrading...

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.