npm package
parse-server
pkg:npm/parse-server
Vulnerabilities (106)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-31875 | Med | 5.9 | >= 9.0.0-alpha.1, < 9.6.0-alpha.7 | 9.6.0-alpha.7 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor authentication (MFA) via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These co | |
| CVE-2026-31872 | Hig | 7.5 | >= 9.0.0-alpha.1, < 9.6.0-alpha.6 | 9.6.0-alpha.6 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker c | |
| CVE-2026-31871 | Cri | 9.8 | >= 9.0.0-alpha.1, < 9.6.0-alpha.5 | 9.6.0-alpha.5 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.5 and 8.6.31, a SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot | |
| CVE-2026-31868 | Med | 6.1 | >= 9.0.0-alpha.1, < 9.6.0-alpha.4 | 9.6.0-alpha.4 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.4 and 8.6.30, an attacker can upload a file with a file extension or content type that is not blocked by the default configuration of the Parse Server file | |
| CVE-2026-31856 | Cri | 9.8 | >= 9.0.0-alpha.1, < 9.6.0-alpha.3 | 9.6.0-alpha.3 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). Th | |
| CVE-2026-31840 | Cri | 9.8 | >= 9.0.0, < 9.6.0-alpha.2 | 9.6.0-alpha.2 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through | |
| CVE-2026-31828 | Hig | 8.8 | >= 9.0.0-alpha.1, < 9.5.2-alpha.13 | 9.5.2-alpha.13 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (authData.id) is interpolated directly into LDAP Distin | |
| CVE-2026-31800 | Cri | 9.1 | >= 9.0.0-alpha.1, < 9.5.2-alpha.12 | 9.5.2-alpha.12 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.12 and 8.6.25, the _GraphQLConfig and _Audience internal classes can be read, modified, and deleted via the generic /classes/_GraphQLConfig and /classes/_A | |
| CVE-2026-30972 | Hig | 7.5 | >= 9.0.0-alpha.1, < 9.5.2-alpha.10 | 9.5.2-alpha.10 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batch) processes sub-req | |
| CVE-2026-30967 | Hig | 8.8 | >= 9.0.0-alpha.1, < 9.5.2-alpha.9 | 9.5.2-alpha.9 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's t | |
| CVE-2026-30966 | Cri | 10.0 | >= 9.0.0-alpha.1, < 9.5.2-alpha.7 | 9.5.2-alpha.7 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or Gr | |
| CVE-2026-30965 | Cri | 9.1 | >= 9.0.0-alpha.1, < 9.5.2-alpha.8 | 9.5.2-alpha.8 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other us | |
| CVE-2026-30962 | Med | 6.5 | >= 9.0.0, < 9.5.2-alpha.6 | 9.5.2-alpha.6 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical op | |
| CVE-2026-30949 | Hig | 8.8 | >= 9.0.0, < 9.5.2-alpha.5 | 9.5.2-alpha.5 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured clien | |
| CVE-2026-30948 | Med | 5.4 | >= 9.0.0, < 9.5.2-alpha.4 | 9.5.2-alpha.4 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.4 and 8.6.17, a stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is serv | |
| CVE-2026-30947 | Hig | 7.5 | >= 9.0.0, < 9.5.2-alpha.3 | 9.5.2-alpha.3 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.3 and 8.6.16, class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any Li | |
| CVE-2026-30946 | Hig | 7.5 | < 8.6.15 | 8.6.15 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack | |
| CVE-2026-30941 | Hig | 7.5 | >= 9.0.0, < 9.5.2-alpha.1 | 9.5.2-alpha.1 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.14 and 9.5.2-alpha.1, NoSQL injection vulnerability allows an unauthenticated attacker to inject MongoDB query operators via the token field in the password reset | |
| CVE-2026-30939 | Hig | 7.5 | < 8.6.13 | 8.6.13 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the fun | |
| CVE-2026-30938 | Med | 5.3 | < 8.6.12 | 8.6.12 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request |
- affected >= 9.0.0-alpha.1, < 9.6.0-alpha.7fixed 9.6.0-alpha.7
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor authentication (MFA) via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These co
- affected >= 9.0.0-alpha.1, < 9.6.0-alpha.6fixed 9.6.0-alpha.6
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker c
- affected >= 9.0.0-alpha.1, < 9.6.0-alpha.5fixed 9.6.0-alpha.5
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.5 and 8.6.31, a SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot
- affected >= 9.0.0-alpha.1, < 9.6.0-alpha.4fixed 9.6.0-alpha.4
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.4 and 8.6.30, an attacker can upload a file with a file extension or content type that is not blocked by the default configuration of the Parse Server file
- affected >= 9.0.0-alpha.1, < 9.6.0-alpha.3fixed 9.6.0-alpha.3
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). Th
- affected >= 9.0.0, < 9.6.0-alpha.2fixed 9.6.0-alpha.2
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through
- affected >= 9.0.0-alpha.1, < 9.5.2-alpha.13fixed 9.5.2-alpha.13
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (authData.id) is interpolated directly into LDAP Distin
- affected >= 9.0.0-alpha.1, < 9.5.2-alpha.12fixed 9.5.2-alpha.12
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.12 and 8.6.25, the _GraphQLConfig and _Audience internal classes can be read, modified, and deleted via the generic /classes/_GraphQLConfig and /classes/_A
- affected >= 9.0.0-alpha.1, < 9.5.2-alpha.10fixed 9.5.2-alpha.10
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batch) processes sub-req
- affected >= 9.0.0-alpha.1, < 9.5.2-alpha.9fixed 9.5.2-alpha.9
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's t
- affected >= 9.0.0-alpha.1, < 9.5.2-alpha.7fixed 9.5.2-alpha.7
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or Gr
- affected >= 9.0.0-alpha.1, < 9.5.2-alpha.8fixed 9.5.2-alpha.8
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other us
- affected >= 9.0.0, < 9.5.2-alpha.6fixed 9.5.2-alpha.6
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical op
- affected >= 9.0.0, < 9.5.2-alpha.5fixed 9.5.2-alpha.5
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured clien
- affected >= 9.0.0, < 9.5.2-alpha.4fixed 9.5.2-alpha.4
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.4 and 8.6.17, a stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is serv
- affected >= 9.0.0, < 9.5.2-alpha.3fixed 9.5.2-alpha.3
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.3 and 8.6.16, class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any Li
- affected < 8.6.15fixed 8.6.15
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack
- affected >= 9.0.0, < 9.5.2-alpha.1fixed 9.5.2-alpha.1
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.14 and 9.5.2-alpha.1, NoSQL injection vulnerability allows an unauthenticated attacker to inject MongoDB query operators via the token field in the password reset
- affected < 8.6.13fixed 8.6.13
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the fun
- affected < 8.6.12fixed 8.6.12
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request
Page 3 of 6