npm

parse-server

100 Total advisories

100 Vulnerabilities

0 Malware

Dependency scanning

Check whether parse-server is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

parse-server

Vulnerabilities

Server crashes on invalid Cloud Function or Cloud Job name

ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection

Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

Parse Server may crash when uploading file without extension

Parse Server option `masterKeyIps` vulnerability to IP spoofing

Parse Server crashes with query parameter

Parse Server stores password in plain text

Parse Server before v3.4.1 vulnerable to Denial of Service

Sensitive Data Exposure in parse-server

Incorrect version tags linked to external repository

parse-server: LiveQuery discloses object data to a subscriber across an ACL read-access change

parse-server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

parse-server: Denial of service via exponential-time processing of deeply nested query operators

parse-server new anonymous user session acts as if it's created with password

receiving subscription objects with deleted session

LiveQuery publishes user session tokens in parse-server

Information disclosure in parse-server

GraphQL: Security breach on Viewer query

parse-server: Server option routeAllowList is bypassable through batch sub-requests

parse-server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist

parse-server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

parse-server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

Parse Server: Pre-authentication denial of service via client version header regex backtracking

Parse Server's GraphQL "Did you mean ...?" validation suggestions disclose schema to unauthenticated callers

parse-server: MFA SMS one-time password accepted twice under concurrent login

Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

Parse Server has a login timing side-channel reveals user existence

Parse Server: File upload Content-Type override via extension mismatch

LiveQuery protected field leak via shared mutable state across concurrent subscribers

Parser Server's streaming file download bypasses afterFind file trigger authorization

Parse Server has a session field immutability bypass via falsy-value guard

parse-server has cloud function validator bypass via prototype chain traversal

GraphQL API endpoint ignores CORS origin restriction

Parse Server exposes auth data via verify password endpoint

Parse Server has a LiveQuery protected-field guard bypass via array-like logical operator value

parse-server has GraphQL complexity validator exponential fragment traversal DoS

Parse Server has an MFA single-use token bypass via concurrent authData login requests

Parse Server has a protected field change detection oracle via LiveQuery watch parameter

Parse Server has an auth provider validation bypass on login via partial authData

Parse Server's Session Update endpoint allows overwriting server-generated session fields

Parse Server email verification resend page leaks user existence

Parse Server LiveQuery subscription query depth bypass

Parse Server has a query condition depth bypass via pre-validation transform pipeline

Parse Server's LiveQuery bypasses CLP pointer permission enforcement

Parse Server exposes auth data via /users/me endpoint

Parse Server: MFA recovery code single-use bypass via concurrent requests

Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter

Parse Server: Denial of Service via unindexed database query for unconfigured auth providers

Parse Server affected by empty authData bypassing credential requirement on signup

Parse Server session creation endpoint allows overwriting server-generated session fields

Parse Server has a password reset token single-use bypass via concurrent requests

Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server crash via deeply nested query condition operators

Parse Server leaks protected fields via LiveQuery afterEvent trigger

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Parse Server LiveQuery subscription with invalid regular expression crashes server

Parse Server's GraphQL WebSocket endpoint bypasses security middleware

Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance

Parse Server: Account takeover via operator injection in authentication data identifier

Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery

Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction

Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

parse-server's file creation and deletion bypasses `readOnlyMasterKey` write restriction

Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user

Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

parse-server: Malformed `$regex` query leaks database error details in API response

Parse Server has a SQL injection via query field name when using PostgreSQL

Parse Server missing audience validation in Keycloak authentication adapter

Parse Server OAuth2 authentication adapter account takeover via identity spoofing

Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes

Parse Server has a NoSQL injection via token type in password reset and email verification endpoints