npm package
parse-server
pkg:npm/parse-server
Vulnerabilities (106)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-31875 | — | >= 9.0.0-alpha.1, < 9.6.0-alpha.7 | 9.6.0-alpha.7 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor authentication (MFA) via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These co | ||
| CVE-2026-31872 | — | >= 9.0.0-alpha.1, < 9.6.0-alpha.6 | 9.6.0-alpha.6 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker c | ||
| CVE-2026-31871 | — | >= 9.0.0-alpha.1, < 9.6.0-alpha.5 | 9.6.0-alpha.5 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.5 and 8.6.31, a SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot | ||
| CVE-2026-31868 | — | >= 9.0.0-alpha.1, < 9.6.0-alpha.4 | 9.6.0-alpha.4 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.4 and 8.6.30, an attacker can upload a file with a file extension or content type that is not blocked by the default configuration of the Parse Server file | ||
| CVE-2026-31856 | — | >= 9.0.0-alpha.1, < 9.6.0-alpha.3 | 9.6.0-alpha.3 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). Th | ||
| CVE-2026-31840 | — | >= 9.0.0, < 9.6.0-alpha.2 | 9.6.0-alpha.2 | Mar 11, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through | ||
| CVE-2026-31828 | — | >= 9.0.0-alpha.1, < 9.5.2-alpha.13 | 9.5.2-alpha.13 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (authData.id) is interpolated directly into LDAP Distin | ||
| CVE-2026-31800 | — | >= 9.0.0-alpha.1, < 9.5.2-alpha.12 | 9.5.2-alpha.12 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.12 and 8.6.25, the _GraphQLConfig and _Audience internal classes can be read, modified, and deleted via the generic /classes/_GraphQLConfig and /classes/_A | ||
| CVE-2026-30972 | — | >= 9.0.0-alpha.1, < 9.5.2-alpha.10 | 9.5.2-alpha.10 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batch) processes sub-req | ||
| CVE-2026-30967 | — | >= 9.0.0-alpha.1, < 9.5.2-alpha.9 | 9.5.2-alpha.9 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's t | ||
| CVE-2026-30966 | — | >= 9.0.0-alpha.1, < 9.5.2-alpha.7 | 9.5.2-alpha.7 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or Gr | ||
| CVE-2026-30965 | — | >= 9.0.0-alpha.1, < 9.5.2-alpha.8 | 9.5.2-alpha.8 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other us | ||
| CVE-2026-30962 | — | >= 9.0.0, < 9.5.2-alpha.6 | 9.5.2-alpha.6 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical op | ||
| CVE-2026-30949 | — | >= 9.0.0, < 9.5.2-alpha.5 | 9.5.2-alpha.5 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured clien | ||
| CVE-2026-30948 | — | >= 9.0.0, < 9.5.2-alpha.4 | 9.5.2-alpha.4 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.4 and 8.6.17, a stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is serv | ||
| CVE-2026-30947 | — | >= 9.0.0, < 9.5.2-alpha.3 | 9.5.2-alpha.3 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.3 and 8.6.16, class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any Li | ||
| CVE-2026-30946 | — | < 8.6.15 | 8.6.15 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack | ||
| CVE-2026-30941 | — | >= 9.0.0, < 9.5.2-alpha.1 | 9.5.2-alpha.1 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.14 and 9.5.2-alpha.1, NoSQL injection vulnerability allows an unauthenticated attacker to inject MongoDB query operators via the token field in the password reset | ||
| CVE-2026-30939 | — | < 8.6.13 | 8.6.13 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the fun | ||
| CVE-2026-30938 | — | < 8.6.12 | 8.6.12 | Mar 10, 2026 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request |
- CVE-2026-31875Mar 11, 2026affected >= 9.0.0-alpha.1, < 9.6.0-alpha.7fixed 9.6.0-alpha.7
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.7 and 8.6.33, when multi-factor authentication (MFA) via TOTP is enabled for a user account, Parse Server generates two single-use recovery codes. These co
- CVE-2026-31872Mar 11, 2026affected >= 9.0.0-alpha.1, < 9.6.0-alpha.6fixed 9.6.0-alpha.6
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.6 and 8.6.32, the protectedFields class-level permission (CLP) can be bypassed using dot-notation in query WHERE clauses and sort parameters. An attacker c
- CVE-2026-31871Mar 11, 2026affected >= 9.0.0-alpha.1, < 9.6.0-alpha.5fixed 9.6.0-alpha.5
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.5 and 8.6.31, a SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot
- CVE-2026-31868Mar 11, 2026affected >= 9.0.0-alpha.1, < 9.6.0-alpha.4fixed 9.6.0-alpha.4
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.4 and 8.6.30, an attacker can upload a file with a file extension or content type that is not blocked by the default configuration of the Parse Server file
- CVE-2026-31856Mar 11, 2026affected >= 9.0.0-alpha.1, < 9.6.0-alpha.3fixed 9.6.0-alpha.3
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. A SQL injection vulnerability exists in the PostgreSQL storage adapter when processing Increment operations on nested object fields using dot notation (e.g., stats.counter). Th
- CVE-2026-31840Mar 11, 2026affected >= 9.0.0, < 9.6.0-alpha.2fixed 9.6.0-alpha.2
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.2 and 8.6.28, an attacker can use a dot-notation field name in combination with the sort query parameter to inject SQL into the PostgreSQL database through
- CVE-2026-31828Mar 10, 2026affected >= 9.0.0-alpha.1, < 9.5.2-alpha.13fixed 9.5.2-alpha.13
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (authData.id) is interpolated directly into LDAP Distin
- CVE-2026-31800Mar 10, 2026affected >= 9.0.0-alpha.1, < 9.5.2-alpha.12fixed 9.5.2-alpha.12
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.12 and 8.6.25, the _GraphQLConfig and _Audience internal classes can be read, modified, and deleted via the generic /classes/_GraphQLConfig and /classes/_A
- CVE-2026-30972Mar 10, 2026affected >= 9.0.0-alpha.1, < 9.5.2-alpha.10fixed 9.5.2-alpha.10
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/batch) processes sub-req
- CVE-2026-30967Mar 10, 2026affected >= 9.0.0-alpha.1, < 9.5.2-alpha.9fixed 9.5.2-alpha.9
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.9. and 8.6.22, the OAuth2 authentication adapter, when configured without the useridField option, only verifies that a token is active via the provider's t
- CVE-2026-30966Mar 10, 2026affected >= 9.0.0-alpha.1, < 9.5.2-alpha.7fixed 9.5.2-alpha.7
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.7 and 8.6.20, Parse Server's internal tables, which store Relation field mappings such as role memberships, can be directly accessed via the REST API or Gr
- CVE-2026-30965Mar 10, 2026affected >= 9.0.0-alpha.1, < 9.5.2-alpha.8fixed 9.5.2-alpha.8
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.8 and 8.6.21, a vulnerability in Parse Server's query handling allows an authenticated or unauthenticated attacker to exfiltrate session tokens of other us
- CVE-2026-30962Mar 10, 2026affected >= 9.0.0, < 9.5.2-alpha.6fixed 9.5.2-alpha.6
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.6 and 8.6.19, the validation for protected fields only checks top-level query keys. By wrapping a query constraint on a protected field inside a logical op
- CVE-2026-30949Mar 10, 2026affected >= 9.0.0, < 9.5.2-alpha.5fixed 9.5.2-alpha.5
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.5 and 8.6.18, the Keycloak authentication adapter does not validate the azp (authorized party) claim of Keycloak access tokens against the configured clien
- CVE-2026-30948Mar 10, 2026affected >= 9.0.0, < 9.5.2-alpha.4fixed 9.5.2-alpha.4
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.4 and 8.6.17, a stored cross-site scripting (XSS) vulnerability allows any authenticated user to upload an SVG file containing JavaScript. The file is serv
- CVE-2026-30947Mar 10, 2026affected >= 9.0.0, < 9.5.2-alpha.3fixed 9.5.2-alpha.3
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.3 and 8.6.16, class-level permissions (CLP) are not enforced for LiveQuery subscriptions. An unauthenticated or unauthorized client can subscribe to any Li
- CVE-2026-30946Mar 10, 2026affected < 8.6.15fixed 8.6.15
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior 9.5.2-alpha.2 and 8.6.15, an unauthenticated attacker can exhaust Parse Server resources (CPU, memory, database connections) through crafted queries that exploit the lack
- CVE-2026-30941Mar 10, 2026affected >= 9.0.0, < 9.5.2-alpha.1fixed 9.5.2-alpha.1
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.14 and 9.5.2-alpha.1, NoSQL injection vulnerability allows an unauthenticated attacker to inject MongoDB query operators via the token field in the password reset
- CVE-2026-30939Mar 10, 2026affected < 8.6.13fixed 8.6.13
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the fun
- CVE-2026-30938Mar 10, 2026affected < 8.6.12fixed 8.6.12
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request
Page 3 of 6