parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Information Exposure via the watch parameter in LiveQuery subscriptions targeting protected fields. An attacker can infer changes to protected fields by observing the presence or absence of update events, effectively revealing sensitive information about those fields without direct access.

Upgrade parse-server to version 8.6.54, 9.6.0-alpha.43 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Incorrect Authorization in the LiveQuery WebSocket interface due to improper enforcement of pointer permissions. An attacker can gain unauthorized access to sensitive data by subscribing to real-time updates for objects in classes protected by pointer permissions, even if the pointer fields do not reference the subscribing user.

Upgrade parse-server to version 8.6.53, 9.6.0-alpha.42 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Uncontrolled Recursion via the pre-validation transform pipeline. An attacker can cause the server process to become permanently unresponsive by sending an unauthenticated HTTP request with a deeply nested query containing logical operators.

Upgrade parse-server to version 8.6.55, 9.6.0-alpha.44 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the improper validation of third-party auth provider's credentials. An attacker can gain unauthorized access to user accounts by providing only the user's provider ID, bypassing credential verification. This is only exploitable if the server option allowExpiredAuthDataToken is set to true.

Upgrade parse-server to version 8.6.52, 9.6.0-alpha.41 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Information Exposure through the Pages and legacy PublicAPI routes that do not respect emailVerifySuccessOnInvalidEmail configuration option. An attacker can determine the existence of valid usernames by submitting requests and observing different redirect targets based on whether the provided username exists and has an unverified email.

Upgrade parse-server to version 8.6.51, 9.6.0-alpha.40 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Information Exposure via the afterLiveQueryEvent trigger. An attacker can access sensitive protected fields and authentication data of other users by subscribing to LiveQuery events for a class with this trigger registered.

Upgrade parse-server to version 8.6.50, 9.6.0-alpha.35 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the Cloud function endpoint. An attacker can cause the server process to crash by invoking a cloud function endpoint with a specially crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, resulting in a stack overflow.

Upgrade parse-server to version 8.6.47, 9.6.0-alpha.24 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Weak Authentication in the user sign up. An attacker can create authenticated sessions without providing valid credentials by submitting an empty authData object during signup, even when anonymous users are disabled.

Upgrade parse-server to version 8.6.49, 9.6.0-alpha.29 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the password reset mechanism. An attacker can gain unauthorized access to a user's account by intercepting a password reset token and submitting concurrent requests, potentially causing the attacker's password to be set instead of the legitimate user's.

Upgrade parse-server to version 8.6.48, 9.6.0-alpha.28 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Prototype Pollution in the deep copy mechanism. An attacker can inject unauthorized fields into class schemas and bypass security restrictions by exploiting prototype pollution in the deep copy process.

Upgrade parse-server to version 8.6.44, 9.6.0-alpha.20 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the LiveQuery subscription when an invalid regular expression pattern is provided. An attacker can cause the server process to terminate, resulting in denial of service for all connected clients by submitting a subscription request containing a malformed regular expression.

Upgrade parse-server to version 8.6.43, 9.6.0-alpha.19 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the POST /classes/_Session endpoint. An attacker can manipulate server-generated session fields such as sessionToken, expiresAt, and createdWith by supplying crafted values, potentially bypassing session expiration policies and setting predictable session tokens.

Upgrade parse-server to version 8.6.42, 9.6.0-alpha.17 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Uncontrolled Recursion while processing of deeply nested query condition operators. An attacker can cause the server process to crash and deny service to all connected clients by sending a single crafted request.

Upgrade parse-server to version 8.6.45, 9.6.0-alpha.21 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the file upload process. An attacker can execute arbitrary scripts in the user's browser by uploading files with specially crafted Content-Type headers or with XML-based file extensions that bypass the blocklist. This can result in the compromise of session tokens, user credentials, or other sensitive data accessible via the browser's local storage.

Workaround

This vulnerability can be mitigated by configuring the fileUpload.fileExtensions option to use an allowlist of only the file extensions required by the application.

Upgrade parse-server to version 8.6.41, 9.6.0-alpha.15 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the createSubscriptions process. An attacker can execute unauthorized GraphQL operations, access schema introspection, and bypass query complexity limits by connecting to the WebSocket endpoint without valid credentials.

Upgrade parse-server to version 8.6.40, 9.6.0-alpha.14 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Incorrect Authorization in the redirectClassNameForKey query parameter handling. An unauthenticated attacker can gain unauthorized access to session tokens of other users by crafting requests that exploit insufficient access control checks after query redirection.

Upgrade parse-server to version 8.6.21, 9.5.2-alpha.8 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Incorrect Authorization in the Keycloak authentication adapter due to missing validation of the azp claim in access tokens against the configured client ID. An attacker can gain unauthorized access to user accounts by presenting a valid access token issued for a different client application within the same Keycloak realm.

Note: This is only exploitable if the Keycloak realm contains multiple client applications and the Keycloak authentication adapter is used.

Upgrade parse-server to version 8.6.18, 9.5.2-alpha.5 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Function Call With Incorrect Order of Arguments in the OAuth2 authentication adapter when both appidField and appIds are configured. An attacker can bypass authentication restrictions or cause authentication failures by exploiting the improper validation of app IDs, which results in a malformed value being sent to the token introspection endpoint instead of the user's actual access token.

Upgrade parse-server to version 8.6.39, 9.6.0-alpha.13 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the findUsersWithAuthData() function of authentication data identifier. An attacker can gain unauthorized access to any user account by sending a specially crafted login request that manipulates the user identifier, causing the server to perform a pattern-matching query instead of an exact-match lookup and returning a valid session token for the targeted account.

Upgrade parse-server to version 8.6.38, 9.6.0-alpha.12 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Race Condition in the OAuth2 auth adapter. An attacker can gain unauthorized access by exploiting a race condition that causes token validation to occur against the wrong provider's configuration during concurrent authentication requests. This is only exploitable if multiple OAuth2 providers are configured via the oauth2: true flag.

Upgrade parse-server to version 8.6.37, 9.6.0-alpha.11 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Information Exposure in the LiveQuery subscription process. An attacker can infer the values of protected fields by crafting a subscription with a WHERE clause that references protected fields, including using dot-notation or $regex, and observing whether LiveQuery events are triggered for matching objects.

Note: This is only exploitable if both protectedFields are configured in Class-Level Permissions and LiveQuery is enabled.

Upgrade parse-server to version 8.6.35, 9.6.0-alpha.9 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to SQL Injection via the query field name when using PostgreSQL. An attacker can execute arbitrary SQL commands by injecting malicious field names in query constraints.

Note: This is only exploitable if the deployment is configured to use PostgreSQL as the database and the attacker possesses the master key.

Upgrade parse-server to version 8.6.36, 9.6.0-alpha.10 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Missing Authorization via direct access to internal relationship tables through the REST API or GraphQL API using only the application key. An attacker can gain unauthorized permissions and access to protected resources by creating, reading, updating, or deleting records in any internal relationship table, which may result in bypassing access controls and escalating privileges.

Upgrade parse-server to version 8.6.20, 9.5.2-alpha.7 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the OAuth2 authentication process when the useridField option is not set. An attacker can gain unauthorized access to other user accounts by authenticating with any valid OAuth2 token from the same provider.

Note: This is only exploitable if the generic OAuth2 authentication adapter is enabled with oauth2: true and the useridField option is not configured.

Upgrade parse-server to version 8.6.22, 9.5.2-alpha.9 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through unbounded query complexity in the REST and GraphQL APIs. An attacker can exhaust server resources, such as CPU, memory, and database connections, by sending specially crafted queries that lack enforced complexity limits.

Upgrade parse-server to version 8.6.15, 9.5.2-alpha.2 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to SQL Injection in the Increment operation on PostgreSQL when handling nested object fields using dot notation. An attacker can execute arbitrary SQL commands or access sensitive database information by crafting a malicious sub-key name containing single quotes in write requests to the REST API.

Upgrade parse-server to version 8.6.31, 9.6.0-alpha.5 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Incorrect Authorization in LiveQuery. An attacker can gain unauthorized access to sensitive data by subscribing to real-time events for any class, regardless of permission restrictions.

Note: This is only exploitable if LiveQuery is enabled for classes with class-level permissions.

Upgrade parse-server to version 8.6.16, 9.5.2-alpha.3 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improper Control of Interaction Frequency in the batch endpoint, which processes sub-requests internally and bypasses the intended rate limiting controls. An attacker can send multiple sub-requests within a single batch to exceed the configured request limits by circumventing the middleware responsible for enforcing rate limits.

Note: This is only exploitable if the deployment relies solely on the built-in rate limiting feature without additional protections such as a reverse proxy or web application firewall.

Upgrade parse-server to version 8.6.23, 9.5.2-alpha.10 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release due to the recovery code. An attacker can repeatedly gain unauthorized access to user accounts by reusing the same recovery code without it being invalidated.

Upgrade parse-server to version 8.6.33, 9.6.0-alpha.7 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the token field in the password reset and email verification endpoints. An attacker can extract sensitive tokens and potentially verify a user's email address without inbox access by injecting MongoDB query operators through crafted requests.

Note This is only exploitable if email verification or password reset is enabled and, for full email verification token extraction, if emailVerifyTokenReuseIfValid is configured.

Upgrade parse-server to version 8.6.14, 9.5.2-alpha.1 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Incorrect Authorization in the handling of protectedFields permissions when processing query WHERE clauses and sort parameters using dot-notation. An attacker can access or enumerate values of protected fields by crafting queries or sort operations that reference sub-fields via dot-notation.

Upgrade parse-server to version 8.6.32, 9.6.0-alpha.6 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Information Exposure in the /verificationEmailRequest endpoint. An attacker can determine whether specific email addresses are registered, already verified, or non-existent by analyzing the distinct error responses returned for each case.

Upgrade parse-server to version 8.6.34, 9.6.0-alpha.8 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the file upload. An attacker can execute arbitrary scripts in the context of the application domain by uploading specially crafted files with certain extensions or content types that are not blocked by default. This can lead to theft of session tokens, redirection of users, or unauthorized actions performed on behalf of users when the uploaded file is accessed in a browser.

Upgrade parse-server to version 8.6.30, 9.6.0-alpha.4 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to LDAP Injection via unsanitized input in the authData.id parameter during the construction of LDAP Distinguished Names and group search filters. An attacker can escalate privileges and bypass group membership restrictions by injecting crafted input.

Note: This is only exploitable if the LDAP authentication adapter is enabled with group-based access control.

Upgrade parse-server to version 8.6.26, 9.5.2-alpha.13 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Incorrect Authorization in the query validation. An authenticated user can access sensitive field values by wrapping constraints on protected fields inside logical query operators, thereby bypassing intended access restrictions.

Upgrade parse-server to version 8.6.19, 9.5.2-alpha.6 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Missing Authorization via the generic /classes/_GraphQLConfig and /classes/_Audience REST API routes, which do not enforce master key authentication. An attacker can read, modify, and delete sensitive configuration and audience data by sending unauthorized requests to these endpoints.

Upgrade parse-server to version 8.6.25, 9.5.2-alpha.12 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to SQL Injection in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation. An attacker can execute arbitrary SQL queries and read sensitive data from the database by injecting malicious input into the amount parameter of a write request to the REST API.

Upgrade parse-server to version 8.6.29, 9.6.0-alpha.3 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to SQL Injection in the handling of dot-notation field names with the sort, distinct, or where query parameters in PostgreSQL deployments. An attacker can execute arbitrary SQL commands by injecting malicious input through these query parameters.

Note: This is only exploitable if the deployment is configured to use a PostgreSQL database.

Upgrade parse-server to version 8.6.28, 9.6.0-alpha.2 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the file upload process. An attacker can execute arbitrary JavaScript in the context of the application origin by uploading a crafted SVG file containing malicious scripts, which are then served inline without protective headers. This can lead to theft of session tokens from localStorage and potential account takeover. This is only exploitable if file upload is enabled for authenticated users, which is the default configuration.

Upgrade parse-server to version 8.6.17, 9.5.2-alpha.4 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Prototype Pollution via triggers.js when a prototype property name is used as the function name. An attacker can terminate the server process or bypass function dispatch validation by sending specially crafted requests that exploit prototype chain resolution. This can result in the server crashing due to infinite recursion or returning unauthorized HTTP 200 responses for undefined functions.

Upgrade parse-server to version 9.5.1-alpha.2, 8.6.13 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the Utils class. An attacker can bypass configured keyword restrictions by placing a nested object or array before a prohibited keyword in the request payload, causing the scan to terminate early and allowing prohibited keywords to be included undetected.

Upgrade parse-server to version 9.5.1-alpha.1, 8.6.12 or higher.