parse-server 8.6.45 vulnerabilities

Direct Vulnerabilities

Known vulnerabilities in the parse-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Uncontrolled Recursion parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion via the pre-validation transform pipeline. An attacker can cause the server process to become permanently unresponsive by sending an unauthenticated HTTP request with a deeply nested query containing logical operators. How to fix Uncontrolled Recursion? Upgrade `parse-server` to version 8.6.55, 9.6.0-alpha.44 or higher.	<8.6.55>=9.0.0-alpha.1 <9.6.0-alpha.44
H Missing Authentication for Critical Function parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the improper validation of third-party auth provider's credentials. An attacker can gain unauthorized access to user accounts by providing only the user's provider ID, bypassing credential verification. This is only exploitable if the server option `allowExpiredAuthDataToken` is set to `true`. How to fix Missing Authentication for Critical Function? Upgrade `parse-server` to version 8.6.52, 9.6.0-alpha.41 or higher.	<8.6.52>=9.0.0-alpha.1 <9.6.0-alpha.41
M Information Exposure parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure through the Pages and legacy PublicAPI routes that do not respect `emailVerifySuccessOnInvalidEmail` configuration option. An attacker can determine the existence of valid usernames by submitting requests and observing different redirect targets based on whether the provided username exists and has an unverified email. How to fix Information Exposure? Upgrade `parse-server` to version 8.6.51, 9.6.0-alpha.40 or higher.	<8.6.51>=9.0.0-alpha.1 <9.6.0-alpha.40
H Information Exposure parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the `afterLiveQueryEvent` trigger. An attacker can access sensitive protected fields and authentication data of other users by subscribing to LiveQuery events for a class with this trigger registered. How to fix Information Exposure? Upgrade `parse-server` to version 8.6.50, 9.6.0-alpha.35 or higher.	<8.6.50>=9.0.0 <9.6.0-alpha.35
H Improperly Controlled Sequential Memory Allocation parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the Cloud function endpoint. An attacker can cause the server process to crash by invoking a cloud function endpoint with a specially crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, resulting in a stack overflow. How to fix Improperly Controlled Sequential Memory Allocation? Upgrade `parse-server` to version 8.6.47, 9.6.0-alpha.24 or higher.	<8.6.47>=9.0.0-alpha.1 <9.6.0-alpha.24
M Weak Authentication parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Weak Authentication in the user sign up. An attacker can create authenticated sessions without providing valid credentials by submitting an empty `authData` object during signup, even when anonymous users are disabled. How to fix Weak Authentication? Upgrade `parse-server` to version 8.6.49, 9.6.0-alpha.29 or higher.	<8.6.49>=9.0.0-alpha.1 <9.6.0-alpha.29
L Time-of-check Time-of-use (TOCTOU) Race Condition parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the password reset mechanism. An attacker can gain unauthorized access to a user's account by intercepting a password reset token and submitting concurrent requests, potentially causing the attacker's password to be set instead of the legitimate user's. How to fix Time-of-check Time-of-use (TOCTOU) Race Condition? Upgrade `parse-server` to version 8.6.48, 9.6.0-alpha.28 or higher.	<8.6.48>=9.0.0-alpha.1 <9.6.0-alpha.28

Vulnerability

Vulnerable Version

Uncontrolled Recursion