[parse-server] Parse Server has a query condition depth bypass via pre-validation transform pipeline

**[parse-server] Parse Server has a query condition depth bypass via pre-validation transform pipeline**

Impact An attacker can send an unauthenticated HTTP request with a deeply nested query containing logical operators to permanently hang the Parse Server process. The server becomes completely unresponsive and must be manually restarted. This is a bypass of the fix for CVE-2026-32944. Patches The query condition nesting depth is now validated before the query enters the transformation pipeline, preventing deeply nested structures from being recursively processed before the existing depth guard can fire. References https://github.com/parse-community/parse-server/security/advisories/GHSA-9fjp-q3c4-6w3j https://github.com/parse-community/parse-server/pull/10257 https://github.com/parse-community/parse-server/pull/10258 https://github.com/advisories/GHSA-9fjp-q3c4-6w3j

---

**[devsupporter 해설]**

이 기사는 GitHub Security Advisories에서 제공하는 최신 개발 동향입니다. 관련 도구나 기술에 대해 더 알아보시려면 원본 링크를 참고하세요.