npm package
parse-server
pkg:npm/parse-server
Vulnerabilities (106)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-33429 | Med | 5.3 | >= 9.0.0, < 9.6.0-alpha.43 | 9.6.0-alpha.43 | Mar 24, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is pr | |
| CVE-2026-33421 | Med | 6.5 | >= 9.0.0, < 9.6.0-alpha.42 | 9.6.0-alpha.42 | Mar 24, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.53 and 9.6.0-alpha.42, Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and | |
| CVE-2026-33409 | Cri | 9.1 | >= 9.0.0, < 9.6.0-alpha.41 | 9.6.0-alpha.41 | Mar 24, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provide | |
| CVE-2026-33323 | Med | 5.3 | >= 9.0.0, < 9.6.0-alpha.40 | 9.6.0-alpha.40 | Mar 24, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whe | |
| CVE-2026-33163 | Med | 6.5 | >= 9.0.0, < 9.6.0-alpha.35 | 9.6.0-alpha.35 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to al | |
| CVE-2026-33042 | Med | 5.3 | >= 9.0.0, < 9.6.0-alpha.29 | 9.6.0-alpha.29 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and password requirement. Thi | |
| CVE-2026-32944 | Hig | 7.5 | >= 9.0.0, < 9.6.0-alpha.21 | 9.6.0-alpha.21 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. Thi | |
| CVE-2026-32943 | Low | 3.1 | >= 9.0.0, < 9.6.0-alpha.28 | 9.6.0-alpha.28 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated t | |
| CVE-2026-32886 | Hig | 7.5 | >= 9.0.0, < 9.6.0-alpha.24 | 9.6.0-alpha.24 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaS | |
| CVE-2026-32878 | Hig | 7.5 | >= 9.0.0, < 9.6.0-alpha.20 | 9.6.0-alpha.20 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted | |
| CVE-2026-32770 | Med | 5.9 | >= 9.0.0, < 9.6.0-alpha.19 | 9.6.0-alpha.19 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process te | |
| CVE-2026-32742 | Med | 4.3 | >= 9.0.0, < 9.6.0-alpha.17 | 9.6.0-alpha.17 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields (`sessionToken`, `expiresAt`, `createdWith`) when creating a session obj | |
| CVE-2026-32728 | Hig | 7.6 | >= 9.0.0, < 9.6.0-alpha.15 | 9.6.0-alpha.15 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.15 and 8.6.41, an attacker who is allowed to upload files can bypass the file extension filter by appending a MIME parameter (e.g. `;charset=utf-8`) to the | |
| CVE-2026-32594 | Hig | 7.3 | >= 9.0.0, < 9.6.0-alpha.14 | 9.6.0-alpha.14 | Mar 16, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, i | |
| CVE-2026-32269 | Med | 6.5 | >= 9.0.0, < 9.6.0-alpha.13 | 9.6.0-alpha.13 | Mar 12, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a | |
| CVE-2026-32248 | Cri | 9.8 | >= 9.0.0, < 9.6.0-alpha.12 | 9.6.0-alpha.12 | Mar 12, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the forma | |
| CVE-2026-32242 | Hig | 7.4 | >= 9.0.0, < 9.6.0-alpha.11 | 9.6.0-alpha.11 | Mar 12, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. | |
| CVE-2026-32234 | Med | 4.7 | >= 9.0.0, < 9.6.0-alpha.10 | 9.6.0-alpha.10 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is co | |
| CVE-2026-32098 | Hig | 7.5 | >= 9.0.0, < 9.6.0-alpha.9 | 9.6.0-alpha.9 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.9 and 8.6.35, an attacker can exploit LiveQuery subscriptions to infer the values of protected fields without directly receiving them. By subscribing with | |
| CVE-2026-31901 | Med | 5.3 | >= 9.0.0-alpha.1, < 9.6.0-alpha.8 | 9.6.0-alpha.8 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to |
- affected >= 9.0.0, < 9.6.0-alpha.43fixed 9.6.0-alpha.43
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is pr
- affected >= 9.0.0, < 9.6.0-alpha.42fixed 9.6.0-alpha.42
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.53 and 9.6.0-alpha.42, Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and
- affected >= 9.0.0, < 9.6.0-alpha.41fixed 9.6.0-alpha.41
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provide
- affected >= 9.0.0, < 9.6.0-alpha.40fixed 9.6.0-alpha.40
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whe
- affected >= 9.0.0, < 9.6.0-alpha.35fixed 9.6.0-alpha.35
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to al
- affected >= 9.0.0, < 9.6.0-alpha.29fixed 9.6.0-alpha.29
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and password requirement. Thi
- affected >= 9.0.0, < 9.6.0-alpha.21fixed 9.6.0-alpha.21
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. Thi
- affected >= 9.0.0, < 9.6.0-alpha.28fixed 9.6.0-alpha.28
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated t
- affected >= 9.0.0, < 9.6.0-alpha.24fixed 9.6.0-alpha.24
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaS
- affected >= 9.0.0, < 9.6.0-alpha.20fixed 9.6.0-alpha.20
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted
- affected >= 9.0.0, < 9.6.0-alpha.19fixed 9.6.0-alpha.19
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process te
- affected >= 9.0.0, < 9.6.0-alpha.17fixed 9.6.0-alpha.17
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields (`sessionToken`, `expiresAt`, `createdWith`) when creating a session obj
- affected >= 9.0.0, < 9.6.0-alpha.15fixed 9.6.0-alpha.15
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.15 and 8.6.41, an attacker who is allowed to upload files can bypass the file extension filter by appending a MIME parameter (e.g. `;charset=utf-8`) to the
- affected >= 9.0.0, < 9.6.0-alpha.14fixed 9.6.0-alpha.14
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, i
- affected >= 9.0.0, < 9.6.0-alpha.13fixed 9.6.0-alpha.13
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a
- affected >= 9.0.0, < 9.6.0-alpha.12fixed 9.6.0-alpha.12
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the forma
- affected >= 9.0.0, < 9.6.0-alpha.11fixed 9.6.0-alpha.11
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations.
- affected >= 9.0.0, < 9.6.0-alpha.10fixed 9.6.0-alpha.10
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is co
- affected >= 9.0.0, < 9.6.0-alpha.9fixed 9.6.0-alpha.9
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.9 and 8.6.35, an attacker can exploit LiveQuery subscriptions to infer the values of protected fields without directly receiving them. By subscribing with
- affected >= 9.0.0-alpha.1, < 9.6.0-alpha.8fixed 9.6.0-alpha.8
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to
Page 2 of 6