parse-server 9.10.1-alpha.14

Direct Vulnerabilities

Known vulnerabilities in the parse-server package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Uncaught Exception parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Uncaught Exception via unhandled errors thrown by the email adapter in `sendVerificationEmail` and `sendPasswordResetEmail` within `UserController.js`. When the email adapter throws during a verification or password reset email send, the unhandled rejection propagates and crashes the server process. An unauthenticated attacker can trigger this condition by initiating an email verification or password reset flow against an account when the configured email adapter is in a faulted state. How to fix Uncaught Exception? Upgrade `parse-server` to version 9.10.2-alpha.6, 8.6.97 or higher.	>=9.0.0 <9.10.2-alpha.6<8.6.97
H Race Condition parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Race Condition via `createTransactionalSession` in `DatabaseController.js`, where a transactional batch request shares its database session state with other concurrent requests. Because each incoming request reuses a cached `DatabaseController` rather than receiving a fresh, request-scoped instance, a failing batch transaction can roll back acknowledged writes belonging to other clients, and on PostgreSQL the transaction can remain open indefinitely, causing subsequent writes to block or fail. How to fix Race Condition? Upgrade `parse-server` to version 9.10.2-alpha.5, 8.6.96 or higher.	>=9.0.0 <9.10.2-alpha.5>=5.4.0 <8.6.96
H Uncaught Exception parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Uncaught Exception via a file pointer object without a URL submitted in an object write request. When `RestWrite` processes an incoming object containing a `__type: 'File'` entry that has no `url` field, the server crashes due to an unhandled error path in `expandFilesInObject` in `FilesController.js`, causing a denial of service. An unauthenticated remote attacker can trigger this crash by sending a write request with a file pointer that omits the URL. How to fix Uncaught Exception? Upgrade `parse-server` to version 9.10.2-alpha.3, 8.6.95 or higher.	>=9.0.0 <9.10.2-alpha.3<8.6.95
L Incorrect Authorization parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Incorrect Authorization in the `handleSession` function within `src/RestWrite.js` when creating a session, where class-level permissions (CLP) for `create` and `addField` are not enforced before the master write is performed. An authenticated attacker can create session objects even when the `_Session` class CLP explicitly denies the `create` or `addField` permissions for that user, bypassing the intended access controls. How to fix Incorrect Authorization? Upgrade `parse-server` to version 9.10.3-alpha.1, 8.6.98 or higher.	>=9.0.0 <9.10.3-alpha.1<8.6.98
M Incorrect Authorization parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Incorrect Authorization via `RestWrite.prototype.execute` in `src/RestWrite.js`, where authorization checks for `_User` update operations were performed after the target account data was read. An unauthenticated or unauthorized attacker can send a `PUT` request targeting another user's object ID and cause validation steps (such as password requirement checks) to execute against the target account's data before authorization is enforced, leaking information about the target account. How to fix Incorrect Authorization? Upgrade `parse-server` to version 9.10.3-alpha.2, 8.6.99 or higher.	>=9.0.0 <9.10.3-alpha.2<8.6.99

Vulnerability

Vulnerable Version

Uncaught Exception