npm package
parse-server
pkg:npm/parse-server
Vulnerabilities (106)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-33429 | — | >= 9.0.0, < 9.6.0-alpha.43 | 9.6.0-alpha.43 | Mar 24, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is pr | ||
| CVE-2026-33421 | — | >= 9.0.0, < 9.6.0-alpha.42 | 9.6.0-alpha.42 | Mar 24, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.53 and 9.6.0-alpha.42, Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and | ||
| CVE-2026-33409 | — | >= 9.0.0, < 9.6.0-alpha.41 | 9.6.0-alpha.41 | Mar 24, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provide | ||
| CVE-2026-33323 | — | >= 9.0.0, < 9.6.0-alpha.40 | 9.6.0-alpha.40 | Mar 24, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whe | ||
| CVE-2026-33163 | — | >= 9.0.0, < 9.6.0-alpha.35 | 9.6.0-alpha.35 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to al | ||
| CVE-2026-33042 | — | >= 9.0.0, < 9.6.0-alpha.29 | 9.6.0-alpha.29 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and password requirement. Thi | ||
| CVE-2026-32944 | — | >= 9.0.0, < 9.6.0-alpha.21 | 9.6.0-alpha.21 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. Thi | ||
| CVE-2026-32943 | — | >= 9.0.0, < 9.6.0-alpha.28 | 9.6.0-alpha.28 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated t | ||
| CVE-2026-32886 | — | >= 9.0.0, < 9.6.0-alpha.24 | 9.6.0-alpha.24 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaS | ||
| CVE-2026-32878 | — | >= 9.0.0, < 9.6.0-alpha.20 | 9.6.0-alpha.20 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted | ||
| CVE-2026-32770 | — | >= 9.0.0, < 9.6.0-alpha.19 | 9.6.0-alpha.19 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process te | ||
| CVE-2026-32742 | — | >= 9.0.0, < 9.6.0-alpha.17 | 9.6.0-alpha.17 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields (`sessionToken`, `expiresAt`, `createdWith`) when creating a session obj | ||
| CVE-2026-32728 | — | >= 9.0.0, < 9.6.0-alpha.15 | 9.6.0-alpha.15 | Mar 18, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.15 and 8.6.41, an attacker who is allowed to upload files can bypass the file extension filter by appending a MIME parameter (e.g. `;charset=utf-8`) to the | ||
| CVE-2026-32594 | — | >= 9.0.0, < 9.6.0-alpha.14 | 9.6.0-alpha.14 | Mar 13, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, i | ||
| CVE-2026-32269 | — | >= 9.0.0, < 9.6.0-alpha.13 | 9.6.0-alpha.13 | Mar 12, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a | ||
| CVE-2026-32248 | — | >= 9.0.0, < 9.6.0-alpha.12 | 9.6.0-alpha.12 | Mar 12, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the forma | ||
| CVE-2026-32242 | — | >= 9.0.0, < 9.6.0-alpha.11 | 9.6.0-alpha.11 | Mar 12, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations. | ||
| CVE-2026-32234 | — | >= 9.0.0, < 9.6.0-alpha.10 | 9.6.0-alpha.10 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is co | ||
| CVE-2026-32098 | — | >= 9.0.0, < 9.6.0-alpha.9 | 9.6.0-alpha.9 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.9 and 8.6.35, an attacker can exploit LiveQuery subscriptions to infer the values of protected fields without directly receiving them. By subscribing with | ||
| CVE-2026-31901 | — | >= 9.0.0-alpha.1, < 9.6.0-alpha.8 | 9.6.0-alpha.8 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to |
- CVE-2026-33429Mar 24, 2026affected >= 9.0.0, < 9.6.0-alpha.43fixed 9.6.0-alpha.43
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is pr
- CVE-2026-33421Mar 24, 2026affected >= 9.0.0, < 9.6.0-alpha.42fixed 9.6.0-alpha.42
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.53 and 9.6.0-alpha.42, Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and
- CVE-2026-33409Mar 24, 2026affected >= 9.0.0, < 9.6.0-alpha.41fixed 9.6.0-alpha.41
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provide
- CVE-2026-33323Mar 24, 2026affected >= 9.0.0, < 9.6.0-alpha.40fixed 9.6.0-alpha.40
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whe
- CVE-2026-33163Mar 18, 2026affected >= 9.0.0, < 9.6.0-alpha.35fixed 9.6.0-alpha.35
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to al
- CVE-2026-33042Mar 18, 2026affected >= 9.0.0, < 9.6.0-alpha.29fixed 9.6.0-alpha.29
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and password requirement. Thi
- CVE-2026-32944Mar 18, 2026affected >= 9.0.0, < 9.6.0-alpha.21fixed 9.6.0-alpha.21
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. Thi
- CVE-2026-32943Mar 18, 2026affected >= 9.0.0, < 9.6.0-alpha.28fixed 9.6.0-alpha.28
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated t
- CVE-2026-32886Mar 18, 2026affected >= 9.0.0, < 9.6.0-alpha.24fixed 9.6.0-alpha.24
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaS
- CVE-2026-32878Mar 18, 2026affected >= 9.0.0, < 9.6.0-alpha.20fixed 9.6.0-alpha.20
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted
- CVE-2026-32770Mar 18, 2026affected >= 9.0.0, < 9.6.0-alpha.19fixed 9.6.0-alpha.19
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. The server process te
- CVE-2026-32742Mar 18, 2026affected >= 9.0.0, < 9.6.0-alpha.17fixed 9.6.0-alpha.17
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields (`sessionToken`, `expiresAt`, `createdWith`) when creating a session obj
- CVE-2026-32728Mar 18, 2026affected >= 9.0.0, < 9.6.0-alpha.15fixed 9.6.0-alpha.15
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.15 and 8.6.41, an attacker who is allowed to upload files can bypass the file extension filter by appending a MIME parameter (e.g. `;charset=utf-8`) to the
- CVE-2026-32594Mar 13, 2026affected >= 9.0.0, < 9.6.0-alpha.14fixed 9.6.0-alpha.14
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enforces authentication, i
- CVE-2026-32269Mar 12, 2026affected >= 9.0.0, < 9.6.0-alpha.13fixed 9.6.0-alpha.13
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During app ID validation, a
- CVE-2026-32248Mar 12, 2026affected >= 9.0.0, < 9.6.0-alpha.12fixed 9.6.0-alpha.12
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.12 and 8.6.38, an unauthenticated attacker can take over any user account that was created with an authentication provider that does not validate the forma
- CVE-2026-32242Mar 12, 2026affected >= 9.0.0, < 9.6.0-alpha.11fixed 9.6.0-alpha.11
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.11 and 8.6.37, Parse Server's built-in OAuth2 auth adapter exports a singleton instance that is reused directly across all OAuth2 provider configurations.
- CVE-2026-32234Mar 11, 2026affected >= 9.0.0, < 9.6.0-alpha.10fixed 9.6.0-alpha.10
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints when Parse Server is co
- CVE-2026-32098Mar 11, 2026affected >= 9.0.0, < 9.6.0-alpha.9fixed 9.6.0-alpha.9
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.9 and 8.6.35, an attacker can exploit LiveQuery subscriptions to infer the values of protected fields without directly receiving them. By subscribing with
- CVE-2026-31901Mar 11, 2026affected >= 9.0.0-alpha.1, < 9.6.0-alpha.8fixed 9.6.0-alpha.8
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an email address belongs to
Page 2 of 6