parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the improper validation of third-party auth provider's credentials. An attacker can gain unauthorized access to user accounts by providing only the user's provider ID, bypassing credential verification. This is only exploitable if the server option allowExpiredAuthDataToken is set to true.

Upgrade parse-server to version 8.6.52, 9.6.0-alpha.41 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Information Exposure through the Pages and legacy PublicAPI routes that do not respect emailVerifySuccessOnInvalidEmail configuration option. An attacker can determine the existence of valid usernames by submitting requests and observing different redirect targets based on whether the provided username exists and has an unverified email.

Upgrade parse-server to version 8.6.51, 9.6.0-alpha.40 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Information Exposure via the afterLiveQueryEvent trigger. An attacker can access sensitive protected fields and authentication data of other users by subscribing to LiveQuery events for a class with this trigger registered.

Upgrade parse-server to version 8.6.50, 9.6.0-alpha.35 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improperly Controlled Sequential Memory Allocation in the Cloud function endpoint. An attacker can cause the server process to crash by invoking a cloud function endpoint with a specially crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, resulting in a stack overflow.

Upgrade parse-server to version 8.6.47, 9.6.0-alpha.24 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Weak Authentication in the user sign up. An attacker can create authenticated sessions without providing valid credentials by submitting an empty authData object during signup, even when anonymous users are disabled.

Upgrade parse-server to version 8.6.49, 9.6.0-alpha.29 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Time-of-check Time-of-use (TOCTOU) Race Condition in the password reset mechanism. An attacker can gain unauthorized access to a user's account by intercepting a password reset token and submitting concurrent requests, potentially causing the attacker's password to be set instead of the legitimate user's.

Upgrade parse-server to version 8.6.48, 9.6.0-alpha.28 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Prototype Pollution in the deep copy mechanism. An attacker can inject unauthorized fields into class schemas and bypass security restrictions by exploiting prototype pollution in the deep copy process.

Upgrade parse-server to version 8.6.44, 9.6.0-alpha.20 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input in the LiveQuery subscription when an invalid regular expression pattern is provided. An attacker can cause the server process to terminate, resulting in denial of service for all connected clients by submitting a subscription request containing a malformed regular expression.

Upgrade parse-server to version 8.6.43, 9.6.0-alpha.19 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the POST /classes/_Session endpoint. An attacker can manipulate server-generated session fields such as sessionToken, expiresAt, and createdWith by supplying crafted values, potentially bypassing session expiration policies and setting predictable session tokens.

Upgrade parse-server to version 8.6.42, 9.6.0-alpha.17 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Uncontrolled Recursion while processing of deeply nested query condition operators. An attacker can cause the server process to crash and deny service to all connected clients by sending a single crafted request.

Upgrade parse-server to version 8.6.45, 9.6.0-alpha.21 or higher.

parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the file upload process. An attacker can execute arbitrary scripts in the user's browser by uploading files with specially crafted Content-Type headers or with XML-based file extensions that bypass the blocklist. This can result in the compromise of session tokens, user credentials, or other sensitive data accessible via the browser's local storage.

Workaround

This vulnerability can be mitigated by configuring the fileUpload.fileExtensions option to use an allowlist of only the file extensions required by the application.

Upgrade parse-server to version 8.6.41, 9.6.0-alpha.15 or higher.