parse-server@8.6.79

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the query-depth processing in validateQueryDepth and ParseLiveQueryServer._handleSubscribe. An attacker can exhaust the server CPU and hang the event loop by sending a query with deeply nested logical operators such as $or, $and, or $nor wrapped inside field-level operators like $elemMatch. The vulnerable recursion did not consistently count logical operators nested under fields, and the object-walking logic could re-traverse nested arrays exponentially. This allows a single small REST or Live Query request to trigger extensive processing, causing latency spikes and service unavailability for other users.

Upgrade parse-server to version 8.6.82, 9.9.1-alpha.12 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the file upload extension check in FilesRouter in src/FilesRouter and FilesController. An attacker can upload a malicious HTML or SVG file by naming it with a non-standard extension such as .svg~, .svg.bak, or .html.old while supplying a dangerous Content-Type, causing the blocklist to miss the real browser-served type. The uploaded content is then stored and later served as active markup, letting the attacker execute scripts in users’ browser when they open the file. This can expose session data, perform actions as the user, or compromise affected accounts.

Notes

• The default bypass is only relevant when the upload is accepted from non-master/API clients and the storage adapter later preserves the client-supplied Content-Type; this includes S3 and GCS as examples of adapters where the uploaded object is served back with that type.
• The default GridFS/filesystem adapter is less exposed to browser execution because it sends X-Content-Type-Options: nosniff, so the issue’s practical impact is narrower there even though the blocklist bypass still exists.

Workaround

• Configure fileUpload.fileExtensions as a strict allowlist of only the file extensions your application needs (for example ["^(png|jpe?g|gif|pdf)$"]) instead of relying on the default blocklist.

Upgrade parse-server to version 8.6.81, 9.9.1-alpha.11 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data disclosure through the ParseLiveQueryServer event serialization in ParseLiveQueryServer.js. An attacker can learn object data they are no longer authorized to read by when a subscribed object transitions from readable to unreadable or from unreadable to readable in the same save. When a leave event is triggered by an ACL read-access revocation, the server sends the object body from the post-save state instead of the last state the subscriber was allowed to see, and when an enter event is triggered by an ACL grant, it can include the pre-grant original object data. This leaks secret field values to LiveQuery subscribers and exposes object contents that should have been hidden after the ACL change.

Workarounds

• Do not change an object's field values and a subscriber's ACL read access in the same save on LiveQuery-enabled classes; perform the ACL change in a separate save before or after the content change to prevent leaking object data in leave or enter events.

Upgrade parse-server to version 8.6.83, 9.9.1-alpha.13 or higher.