npmPackage

parse-server

118 known vulnerabilities (16 critical, 51 high, 39 medium, 10 low), with the versions each affects and the releases that fix them.

Latest release: 9.11.0 (Nov 3, 2026): no advisory affects it
Newest unaffected release: 9.11.0 (Nov 3, 2026), the latest release
Advisories: 118 · 16 critical, 51 high, 39 medium, 10 low

Weekly downloads: 81.6K
Dependents: 4
Releases: 500+ since 6.5.10 (Oct 12, 2024)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-61448
Affects 6.5.10 to 8.6.83 (8.6.84 is outside it); 9.0.0 to 9.10.0-alpha.1 (9.10.0-alpha.2 is outside it)
CVE-2026-57481
Affects 6.5.10 to 8.6.82 (8.6.83 is outside it); 9.0.0 to 9.9.1-alpha.12 (9.9.1-alpha.13 is outside it)
CVE-2026-57480
Affects 6.5.10 to 8.6.81 (8.6.82 is outside it); 9.0.0 to 9.9.1-alpha.11 (9.9.1-alpha.12 is outside it)
CVE-2026-55778
Affects 6.5.10 to 8.6.80 (8.6.81 is outside it); 9.0.0 to 9.9.1-alpha.10 (9.9.1-alpha.11 is outside it)
CVE-2021-47987
No published release is affected
No published release is affected
CVE-2021-47986
No published release is affected
No published release is affected
CVE-2026-53726
Affects 6.5.10 to 8.6.79 (8.6.80 is outside it); 9.0.0 to 9.9.1-alpha.5 (9.9.1-alpha.6 is outside it)
CVE-2026-53725
Affects 9.8.0 to 9.9.1-alpha.4 (9.9.1-alpha.5 is outside it)
CVE-2026-53724
Affects 6.5.10 to 8.6.78 (8.6.79 is outside it); 9.0.0 to 9.9.1-alpha.3 (9.9.1-alpha.4 is outside it)
CVE-2026-50008
Affects 9.8.0 to 9.9.1-alpha.2 (9.9.1-alpha.3 is outside it)
CVE-2026-47138
Affects 6.5.10 to 8.6.76 (8.6.77 is outside it); 9.0.0 to 9.9.0 (9.9.1-alpha.1 is outside it)
CVE-2026-47248
Affects 6.5.10 to 8.6.77 (8.6.78 is outside it); 9.0.0 to 9.9.1-alpha.1 (9.9.1-alpha.2 is outside it)

Show all 118 advisoriesShow fewer advisories

CVE-2026-43930
Affects 6.5.10 to 8.6.75 (8.6.76 is outside it); 9.0.0 to 9.9.0-alpha.1 (9.9.0-alpha.2 is outside it)
CVE-2026-39381
Affects 7.3.0 to 8.6.74 (8.6.75 is outside it); 9.0.0 to 9.8.0-alpha.6 (9.8.0-alpha.7 is outside it)
CVE-2026-39321
Affects 6.5.10 to 8.6.73 (8.6.74 is outside it); 9.0.0 to 9.8.0-alpha.5 (9.8.0-alpha.6 is outside it)
CVE-2026-35200
Affects 6.5.10 to 8.6.72 (8.6.73 is outside it); 9.0.0 to 9.7.1-alpha.3 (9.7.1-alpha.4 is outside it)
CVE-2026-34784
Affects 6.5.10 to 8.6.70 (8.6.71 is outside it); 9.0.0 to 9.7.0 (9.7.1-alpha.1 is outside it)
CVE-2026-34215
Affects 6.5.10 to 8.6.62 (8.6.63 is outside it); 9.0.0 to 9.7.0-alpha.6 (9.7.0-alpha.7 is outside it)
CVE-2026-34595
Affects 6.5.10 to 8.6.69 (8.6.70 is outside it); 9.0.0 to 9.7.0-alpha.15 (9.7.0-alpha.16 is outside it)
CVE-2026-34574
Affects 6.5.10 to 8.6.68 (8.6.69 is outside it); 9.0.0 to 9.7.0-alpha.13 (9.7.0-alpha.14 is outside it)
CVE-2026-34573
Affects 6.5.10 to 8.6.67 (8.6.68 is outside it); 9.0.0 to 9.7.0-alpha.11 (9.7.0-alpha.12 is outside it)
CVE-2026-34532
Affects 6.5.10 to 8.6.66 (8.6.67 is outside it); 9.0.0 to 9.7.0-alpha.10 (9.7.0-alpha.11 is outside it)
CVE-2026-34373
Affects 6.5.10 to 8.6.65 (8.6.66 is outside it); 9.0.0 to 9.7.0-alpha.9 (9.7.0-alpha.10 is outside it)
CVE-2026-34363
Affects 6.5.10 to 8.6.64 (8.6.65 is outside it); 9.0.0 to 9.7.0-alpha.8 (9.7.0-alpha.9 is outside it)
CVE-2026-34224
Affects 6.5.10 to 8.6.63 (8.6.64 is outside it); 9.0.0 to 9.7.0-alpha.7 (9.7.0-alpha.8 is outside it)
CVE-2026-33627
Affects 6.5.10 to 8.6.60 (8.6.61 is outside it); 9.0.0 to 9.6.0-alpha.54 (9.6.0-alpha.55 is outside it)
CVE-2026-33624
Affects 6.5.10 to 8.6.59 (8.6.60 is outside it); 9.0.0 to 9.6.0-alpha.53 (9.6.0-alpha.54 is outside it)
CVE-2026-33539
Affects 6.5.10 to 8.6.58 (8.6.59 is outside it); 9.0.0 to 9.6.0-alpha.52 (9.6.0-alpha.53 is outside it)
CVE-2026-33538
Affects 6.5.10 to 8.6.57 (8.6.58 is outside it); 9.0.0 to 9.6.0-alpha.51 (9.6.0-alpha.52 is outside it)
CVE-2026-33527
Affects 6.5.10 to 8.6.56 (8.6.57 is outside it); 9.0.0 to 9.6.0-alpha.47 (9.6.0-alpha.48 is outside it)
CVE-2026-33508
Affects 6.5.10 to 8.6.55 (8.6.56 is outside it); 9.0.0 to 9.6.0-alpha.44 (9.6.0-alpha.45 is outside it)
CVE-2026-33498
Affects 6.5.10 to 8.6.54 (8.6.55 is outside it); 9.0.0 to 9.6.0-alpha.43 (9.6.0-alpha.44 is outside it)
CVE-2026-33429
Affects 6.5.10 to 8.6.53 (8.6.54 is outside it); 9.0.0 to 9.6.0-alpha.42 (9.6.0-alpha.43 is outside it)
CVE-2026-33421
Affects 6.5.10 to 8.6.52 (8.6.53 is outside it); 9.0.0 to 9.6.0-alpha.41 (9.6.0-alpha.42 is outside it)
CVE-2026-33409
Affects 6.5.10 to 8.6.51 (8.6.52 is outside it); 9.0.0 to 9.6.0-alpha.40 (9.6.0-alpha.41 is outside it)
CVE-2026-33323
Affects 6.5.10 to 8.6.50 (8.6.51 is outside it); 9.0.0 to 9.6.0-alpha.39 (9.6.0-alpha.40 is outside it)
CVE-2026-33163
Affects 6.5.10 to 8.6.49 (8.6.50 is outside it); 9.0.0 to 9.6.0-alpha.34 (9.6.0-alpha.35 is outside it)
CVE-2026-33042
Affects 6.5.10 to 8.6.48 (8.6.49 is outside it); 9.0.0 to 9.6.0-alpha.28 (9.6.0-alpha.29 is outside it)
CVE-2026-32944
Affects 6.5.10 to 8.6.44 (8.6.45 is outside it); 9.0.0 to 9.6.0-alpha.20 (9.6.0-alpha.21 is outside it)
CVE-2026-32943
Affects 6.5.10 to 8.6.47 (8.6.48 is outside it); 9.0.0 to 9.6.0-alpha.27 (9.6.0-alpha.28 is outside it)
CVE-2026-32886
Affects 6.5.10 to 8.6.46 (8.6.47 is outside it); 9.0.0 to 9.6.0-alpha.23 (9.6.0-alpha.24 is outside it)
CVE-2026-32878
Affects 6.5.10 to 8.6.43 (8.6.44 is outside it); 9.0.0 to 9.6.0-alpha.19 (9.6.0-alpha.20 is outside it)
CVE-2026-32770
Affects 6.5.10 to 8.6.42 (8.6.43 is outside it); 9.0.0 to 9.6.0-alpha.18 (9.6.0-alpha.19 is outside it)
CVE-2026-32742
Affects 6.5.10 to 8.6.41 (8.6.42 is outside it); 9.0.0 to 9.6.0-alpha.16 (9.6.0-alpha.17 is outside it)
CVE-2026-32728
Affects 6.5.10 to 8.6.40 (8.6.41 is outside it); 9.0.0 to 9.6.0-alpha.14 (9.6.0-alpha.15 is outside it)
CVE-2026-32594
Affects 6.5.10 to 8.6.39 (8.6.40 is outside it); 9.0.0 to 9.6.0-alpha.13 (9.6.0-alpha.14 is outside it)
CVE-2026-32269
Affects 8.0.2 to 8.6.38 (8.6.39 is outside it); 9.0.0 to 9.6.0-alpha.12 (9.6.0-alpha.13 is outside it)
CVE-2026-32248
Affects 6.5.10 to 8.6.37 (8.6.38 is outside it); 9.0.0 to 9.6.0-alpha.11 (9.6.0-alpha.12 is outside it)
CVE-2026-32242
Affects 6.5.10 to 8.6.36 (8.6.37 is outside it); 9.0.0 to 9.6.0-alpha.10 (9.6.0-alpha.11 is outside it)
CVE-2026-32234
Affects 6.5.10 to 8.6.35 (8.6.36 is outside it); 9.0.0 to 9.6.0-alpha.9 (9.6.0-alpha.10 is outside it)
CVE-2026-32098
Affects 6.5.10 to 8.6.34 (8.6.35 is outside it); 9.0.0 to 9.6.0-alpha.8 (9.6.0-alpha.9 is outside it)
CVE-2026-31901
Affects 6.5.10 to 8.6.33 (8.6.34 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.7 (9.6.0-alpha.8 is outside it)
CVE-2026-31875
Affects 6.5.10 to 8.6.32 (8.6.33 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.6 (9.6.0-alpha.7 is outside it)
CVE-2026-31872
Affects 6.5.10 to 8.6.31 (8.6.32 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.5 (9.6.0-alpha.6 is outside it)
CVE-2026-31871
Affects 6.5.10 to 8.6.30 (8.6.31 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.4 (9.6.0-alpha.5 is outside it)
CVE-2026-31868
Affects 6.5.10 to 8.6.29 (8.6.30 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.3 (9.6.0-alpha.4 is outside it)
CVE-2026-31856
Affects 6.5.10 to 8.6.28 (8.6.29 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.2 (9.6.0-alpha.3 is outside it)
CVE-2026-31840
Affects 6.5.10 to 8.6.27 (8.6.28 is outside it); 9.0.0 to 9.6.0-alpha.1 (9.6.0-alpha.2 is outside it)
CVE-2026-31828
Affects 6.5.10 to 8.6.25 (8.6.26 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.12 (9.5.2-alpha.13 is outside it)
CVE-2026-31800
Affects 6.5.10 to 8.6.24 (8.6.25 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.11 (9.5.2-alpha.12 is outside it)
CVE-2026-30972
Affects 6.5.10 to 8.6.22 (8.6.23 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.9 (9.5.2-alpha.10 is outside it)
CVE-2026-30967
Affects 6.5.10 to 8.6.21 (8.6.22 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.8 (9.5.2-alpha.9 is outside it)
CVE-2026-30966
Affects 6.5.10 to 8.6.19 (8.6.20 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.6 (9.5.2-alpha.7 is outside it)
CVE-2026-30965
Affects 6.5.10 to 8.6.20 (8.6.21 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.7 (9.5.2-alpha.8 is outside it)
CVE-2026-30962
Affects 6.5.10 to 8.6.18 (8.6.19 is outside it); 9.0.0 to 9.5.2-alpha.5 (9.5.2-alpha.6 is outside it)
CVE-2026-30949
Affects 6.5.10 to 8.6.17 (8.6.18 is outside it); 9.0.0 to 9.5.2-alpha.4 (9.5.2-alpha.5 is outside it)
CVE-2026-30948
Affects 6.5.10 to 8.6.16 (8.6.17 is outside it); 9.0.0 to 9.5.2-alpha.3 (9.5.2-alpha.4 is outside it)
CVE-2026-30947
Affects 6.5.10 to 8.6.15 (8.6.16 is outside it); 9.0.0 to 9.5.2-alpha.2 (9.5.2-alpha.3 is outside it)
CVE-2026-30946
Affects 6.5.10 to 8.6.14 (8.6.15 is outside it); 9.0.0 to 9.5.2-alpha.1 (9.5.2-alpha.2 is outside it)
CVE-2026-30941
Affects 6.5.10 to 8.6.13 (8.6.14 is outside it); 9.0.0 to 9.5.1 (9.5.2-alpha.1 is outside it)
CVE-2026-30939
Affects 6.5.10 to 8.6.12 (8.6.13 is outside it); 9.0.0-alpha.1 to 9.5.1-alpha.1 (9.5.1-alpha.2 is outside it)
CVE-2026-30938
Affects 6.5.10 to 8.6.11 (8.6.12 is outside it); 9.0.0-alpha.1 to 9.5.0 (9.5.1-alpha.1 is outside it)
CVE-2026-30925
Affects 6.5.10 to 8.6.10 (8.6.11 is outside it); 9.0.0-alpha.1 to 9.5.0-alpha.13 (9.5.0-alpha.14 is outside it)
CVE-2026-30854
Affects 9.3.1-alpha.3 to 9.5.0-alpha.9 (9.5.0-alpha.10 is outside it)
CVE-2026-30850
Affects 6.5.10 to 8.6.8 (8.6.9 is outside it); 9.0.0-alpha.1 to 9.5.0-alpha.8 (9.5.0-alpha.9 is outside it)
CVE-2026-30848
Affects 6.5.10 to 8.6.7 (8.6.8 is outside it); 9.0.0-alpha.1 to 9.5.0-alpha.7 (9.5.0-alpha.8 is outside it)
CVE-2026-30863
Affects 6.5.10 to 8.6.9 (8.6.10 is outside it); 9.0.0-alpha.1 to 9.5.0-alpha.10 (9.5.0-alpha.11 is outside it)
CVE-2026-30835
Affects 6.5.10 to 8.6.6 (8.6.7 is outside it); 9.0.0 to 9.5.0-alpha.5 (9.5.0-alpha.6 is outside it)
CVE-2026-30229
Affects 6.5.10 to 8.6.5 (8.6.6 is outside it); 9.0.0 to 9.5.0-alpha.3 (9.5.0-alpha.4 is outside it)
CVE-2026-30228
Affects 6.5.10 to 8.6.4 (8.6.5 is outside it); 9.0.0 to 9.5.0-alpha.2 (9.5.0-alpha.3 is outside it)
CVE-2026-29182
Affects 6.5.10 to 8.6.3 (8.6.4 is outside it); 9.0.0 to 9.4.1-alpha.2 (9.4.1-alpha.3 is outside it)
CVE-2026-27804
Affects 6.5.10 to 8.6.2 (8.6.3 is outside it); 9.0.0 to 9.3.1-alpha.3 (9.3.1-alpha.4 is outside it)
CVE-2025-68150
Affects 6.5.10 to 8.6.1 (8.6.2 is outside it); 9.0.0 to 9.1.0 (9.1.1-alpha.1 is outside it)
CVE-2025-68115
Affects 6.5.10 to 8.6.0 (8.6.1 is outside it); 9.0.0 to 9.1.0-alpha.2 (9.1.0-alpha.3 is outside it)
CVE-2025-64502
Affects 6.5.10 to 8.5.0-alpha.4 (8.5.0-alpha.5 is outside it)
CVE-2025-64430
Affects 6.5.10 to 7.5.3 (7.5.4 is outside it); 8.0.0 to 8.4.0-alpha.1 (8.4.0-alpha.2 is outside it)
CVE-2025-53364
Affects 6.5.10 to 7.5.2 (7.5.3 is outside it); 8.0.0 to 8.2.2-alpha.1 (8.2.2 is outside it)
CVE-2025-30168
Affects 6.5.10 to 7.5.1 (7.5.2 is outside it); 8.0.0 to 8.0.2-alpha.1 (8.0.2 is outside it)
CVE-2024-47183
No published release is affected
No published release is affected
CVE-2024-39309
No published release is affected
No published release is affected
CVE-2024-29027
No published release is affected
No published release is affected
CVE-2024-27298
No published release is affected
No published release is affected
CVE-2023-46119
No published release is affected
No published release is affected
CVE-2023-41058
No published release is affected
No published release is affected
CVE-2023-36475
No published release is affected
No published release is affected
CVE-2023-32689
No published release is affected
No published release is affected
CVE-2023-22474
No published release is affected
No published release is affected
CVE-2022-41879
No published release is affected
No published release is affected
CVE-2022-41878
No published release is affected
No published release is affected
CVE-2022-39396
No published release is affected
No published release is affected
CVE-2022-39313
No published release is affected
No published release is affected
CVE-2022-39231
No published release is affected
No published release is affected
CVE-2022-39225
No published release is affected
No published release is affected
CVE-2022-36079
No published release is affected
No published release is affected
CVE-2022-31112
No published release is affected
No published release is affected
CVE-2022-31089
No published release is affected
No published release is affected
CVE-2022-31083
No published release is affected
No published release is affected
CVE-2022-24901
No published release is affected
No published release is affected
CVE-2022-24760
No published release is affected
No published release is affected
CVE-2021-41109
No published release is affected
No published release is affected
CVE-2021-39187
No published release is affected
No published release is affected
CVE-2021-39138
No published release is affected
No published release is affected
CVE-2020-26288
No published release is affected
No published release is affected
CVE-2020-15270
No published release is affected
No published release is affected
CVE-2020-15126
No published release is affected
No published release is affected
CVE-2020-5251
No published release is affected
No published release is affected
CVE-2019-1020013
No published release is affected
No published release is affected
CVE-2019-1020012
No published release is affected
No published release is affected

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 118

CVE-2026-61448Low 2.1
Parse Server 9.0.0 Stored XSS via malformed Content-Type
Affected: from 9.0.0, fixed in 9.10.0-alpha.2; fixed in 8.6.84.
Fixed in 8.6.84 (released Jun 25, 2026, 16 days before disclosure) and 9.10.0-alpha.2 (released Jun 25, 2026, 16 days before disclosure).
The latest release, 9.11.0, is not affected.
47% of parse-server downloads last week were affected versions (31.2K).
CVE-2026-57481Low 2.3
Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change
Affected: from 9.0.0, fixed in 9.9.1-alpha.13; fixed in 8.6.83.
Fixed in 8.6.83 (released Jun 19, 2026, 19 days before disclosure) and 9.9.1-alpha.13 (released Jun 19, 2026, 19 days before disclosure).
The latest release, 9.11.0, is not affected.
46% of parse-server downloads last week were affected versions (31.2K).
CVE-2026-57480High 8.7
Parse Server: Denial of service via exponential-time processing of deeply nested query operators
Affected: from 9.0.0, fixed in 9.9.1-alpha.12; fixed in 8.6.82.
Fixed in 8.6.82 (released Jun 17, 2026, 21 days before disclosure) and 9.9.1-alpha.12 (released Jun 17, 2026, 21 days before disclosure).
The latest release, 9.11.0, is not affected.
46% of parse-server downloads last week were affected versions (31.1K).
CVE-2026-55778Low 2.1
Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist
Affected: from 9.0.0, fixed in 9.9.1-alpha.11; fixed in 8.6.81.
Fixed in 8.6.81 (released Jun 16, 2026, 22 days before disclosure) and 9.9.1-alpha.11 (released Jun 16, 2026, 22 days before disclosure).
The latest release, 9.11.0, is not affected.
46% of parse-server downloads last week were affected versions (31.1K).
CVE-2021-47987High 7.7
Parse Server - Arbitrary Code Execution via Malicious Version Tags
Affected: from 4.0.0, fixed in 4.5.2; from 4.6.0, fixed in 4.10.0.
Fixed in 4.5.2 and 4.10.0.
The latest release, 9.11.0, is not affected.
0.8% of parse-server downloads last week were affected versions (547).
CVE-2021-47986High 7.7
Parse Server - Unreviewed Code Execution via Malicious Version Tags
Affected: from 4.0.0, fixed in 4.5.2; from 4.6.0, fixed in 4.10.0.
Fixed in 4.5.2 and 4.10.0.
The latest release, 9.11.0, is not affected.
0.8% of parse-server downloads last week were affected versions (547).
CVE-2026-53726Medium 6.9
Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL
Affected: from 9.0.0, fixed in 9.9.1-alpha.6; fixed in 8.6.80.
Fixed in 8.6.80 (released Jun 3, 2026, 9 days before disclosure) and 9.9.1-alpha.6 (released Jun 3, 2026, 9 days before disclosure).
The latest release, 9.11.0, is not affected.
46% of parse-server downloads last week were affected versions (31.1K).
CVE-2026-53725Medium 5.9
Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied
Affected: from 9.8.0, fixed in 9.9.1-alpha.5.
Fixed in 9.9.1-alpha.5 (released Jun 3, 2026, 9 days before disclosure).
The latest release, 9.11.0, is not affected.
2% of parse-server downloads last week were affected versions (1.3K).
CVE-2026-53724Low 2.1
Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist
Affected: from 9.0.0, fixed in 9.9.1-alpha.4; fixed in 8.6.79.
Fixed in 8.6.79 (released Jun 1, 2026, 11 days before disclosure) and 9.9.1-alpha.4 (released Jun 1, 2026, 11 days before disclosure).
The latest release, 9.11.0, is not affected.
46% of parse-server downloads last week were affected versions (31.1K).
CVE-2026-50008Medium 6.9
Parse Server: Server option routeAllowList is bypassable through batch sub-requests
Affected: from 9.8.0, fixed in 9.9.1-alpha.3.
Fixed in 9.9.1-alpha.3 (released May 27, 2026, 16 days before disclosure).
The latest release, 9.11.0, is not affected.
2% of parse-server downloads last week were affected versions (1.3K).
CVE-2026-47138High 8.7
Parse Server: Pre-authentication denial of service via client version header regex backtracking
Affected: from 9.0.0, fixed in 9.9.1-alpha.1; fixed in 8.6.77.
Fixed in 8.6.77 (released May 17, 2026, 26 days before disclosure) and 9.9.1-alpha.1 (released May 17, 2026, 26 days before disclosure).
The latest release, 9.11.0, is not affected.
46% of parse-server downloads last week were affected versions (31K).
CVE-2026-47248Medium 6.9
Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers
Affected: from 9.0.0, fixed in 9.9.1-alpha.2; fixed in 8.6.78.
Fixed in 8.6.78 (released May 18, 2026, 25 days before disclosure) and 9.9.1-alpha.2 (released May 18, 2026, 25 days before disclosure).
The latest release, 9.11.0, is not affected.
46% of parse-server downloads last week were affected versions (31.1K).
CVE-2026-43930Low 2.1
Parse Server: MFA SMS one-time password accepted twice under concurrent login
Affected: from 9.0.0, fixed in 9.9.0-alpha.2; fixed in 8.6.76.
Fixed in 8.6.76 (released Apr 26, 2026, 16 days before disclosure) and 9.9.0-alpha.2 (released Apr 26, 2026, 16 days before disclosure).
The latest release, 9.11.0, is not affected.
44% of parse-server downloads last week were affected versions (29.4K).
CVE-2026-39381Medium 5.3
Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`
Affected: from 9.0.0, fixed in 9.8.0-alpha.7; from 7.0.0, fixed in 8.6.75.
Fixed in 8.6.75 (released Apr 6, 2026, 1 day before disclosure) and 9.8.0-alpha.7 (released Apr 6, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
21% of parse-server downloads last week were affected versions (14.4K).
CVE-2026-39321Medium 6.3
Parse Server has a login timing side-channel reveals user existence
Affected: from 9.0.0, fixed in 9.8.0-alpha.6; fixed in 8.6.74.
Fixed in 8.6.74 (released Apr 5, 2026, 2 days before disclosure) and 9.8.0-alpha.6 (released Apr 5, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
43% of parse-server downloads last week were affected versions (29.1K).

Show all 118 advisoriesShow fewer advisories

CVE-2026-35200Low 2.1
Parse Server has a file upload Content-Type override via extension mismatch
Affected: from 9.0.0, fixed in 9.7.1-alpha.4; fixed in 8.6.73.
Fixed in 8.6.73 (released Apr 2, 2026, 4 days before disclosure) and 9.7.1-alpha.4 (released Apr 2, 2026, 4 days before disclosure).
The latest release, 9.11.0, is not affected.
43% of parse-server downloads last week were affected versions (29.1K).
CVE-2026-34784High 8.2
Parse Server: Streaming file download bypasses afterFind file trigger authorization
Affected: from 9.0.0, fixed in 9.7.1-alpha.1; fixed in 8.6.71.
Fixed in 8.6.71 (released Mar 30, 2026, 1 day before disclosure) and 9.7.1-alpha.1 (released Mar 30, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
43% of parse-server downloads last week were affected versions (29.1K).
CVE-2026-34215High 8.2
Parse Server: Auth data exposed via verify password endpoint
Affected: from 9.0.0, fixed in 9.7.0-alpha.7; fixed in 8.6.63.
Fixed in 8.6.63 (released Mar 26, 2026, 5 days before disclosure) and 9.7.0-alpha.7 (released Mar 26, 2026, 5 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28.1K).
CVE-2026-34595Medium 5.3
Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value
Affected: from 9.0.0, fixed in 9.7.0-alpha.16; fixed in 8.6.70.
Fixed in 8.6.70 (released Mar 29, 2026, 2 days before disclosure) and 9.7.0-alpha.16 (released Mar 29, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28.1K).
CVE-2026-34574Medium 5.3
Parse Server: Session field immutability bypass via falsy-value guard
Affected: from 9.0.0, fixed in 9.7.0-alpha.14; fixed in 8.6.69.
Fixed in 8.6.69 (released Mar 29, 2026, 2 days before disclosure) and 9.7.0-alpha.14 (released Mar 29, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28.1K).
CVE-2026-34573High 8.2
Parse Server: GraphQL complexity validator exponential fragment traversal DoS
Affected: from 9.0.0, fixed in 9.7.0-alpha.12; fixed in 8.6.68.
Fixed in 8.6.68 (released Mar 29, 2026, 2 days before disclosure) and 9.7.0-alpha.12 (released Mar 29, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28.1K).
CVE-2026-34532Critical 9.1
Parse Server: Cloud function validator bypass via prototype chain traversal
Affected: from 9.0.0, fixed in 9.7.0-alpha.11; fixed in 8.6.67.
Fixed in 8.6.67 (released Mar 28, 2026, 3 days before disclosure) and 9.7.0-alpha.11 (released Mar 28, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28.1K).
CVE-2026-34373Medium 5.3
Parse Server: GraphQL API endpoint ignores CORS origin restriction
Affected: from 9.0.0, fixed in 9.7.0-alpha.10; from 3.5.0, fixed in 8.6.66.
Fixed in 8.6.66 (released Mar 27, 2026, 4 days before disclosure) and 9.7.0-alpha.10 (released Mar 27, 2026, 4 days before disclosure).
The latest release, 9.11.0, is not affected.
39% of parse-server downloads last week were affected versions (26.3K).
CVE-2026-34363High 8.2
Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers
Affected: from 9.0.0, fixed in 9.7.0-alpha.9; fixed in 8.6.65.
Fixed in 8.6.65 (released Mar 27, 2026, 4 days before disclosure) and 9.7.0-alpha.9 (released Mar 27, 2026, 4 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28.1K).
CVE-2026-34224Low 2.1
Parse Server: MFA single-use token bypass via concurrent authData login requests
Affected: from 9.0.0, fixed in 9.7.0-alpha.8; fixed in 8.6.64.
Fixed in 8.6.64 (released Mar 26, 2026, 5 days before disclosure) and 9.7.0-alpha.8 (released Mar 26, 2026, 5 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28.1K).
CVE-2026-33627High 7.1
Parse Server: Auth data exposed via /users/me endpoint
Affected: from 9.0.0, fixed in 9.6.0-alpha.55; fixed in 8.6.61.
Fixed in 8.6.61 (released Mar 22, 2026, 2 days before disclosure) and 9.6.0-alpha.55 (released Mar 22, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33624Low 2.1
Parse Server: MFA recovery code single-use bypass via concurrent requests
Affected: from 9.0.0, fixed in 9.6.0-alpha.54; fixed in 8.6.60.
Fixed in 8.6.60 (released Mar 22, 2026, 2 days before disclosure) and 9.6.0-alpha.54 (released Mar 22, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33539High 8.6
Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter
Affected: from 9.0.0, fixed in 9.6.0-alpha.53; fixed in 8.6.59.
Fixed in 8.6.59 (released Mar 21, 2026, 3 days before disclosure) and 9.6.0-alpha.53 (released Mar 21, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33538High 8.7
Parse Server: Denial of service via unindexed database query for unconfigured auth providers
Affected: from 9.0.0, fixed in 9.6.0-alpha.52; fixed in 8.6.58.
Fixed in 8.6.58 (released Mar 21, 2026, 3 days before disclosure) and 9.6.0-alpha.52 (released Mar 21, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33527Medium 5.3
Parse Server: Session update endpoint allows overwriting server-generated session fields
Affected: from 9.0.0, fixed in 9.6.0-alpha.48; fixed in 8.6.57.
Fixed in 8.6.57 (released Mar 21, 2026, 3 days before disclosure) and 9.6.0-alpha.48 (released Mar 21, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33508High 8.2
Parse Server: LiveQuery subscription query depth bypass
Affected: from 9.0.0, fixed in 9.6.0-alpha.45; fixed in 8.6.56.
Fixed in 8.6.56 (released Mar 20, 2026, 4 days before disclosure) and 9.6.0-alpha.45 (released Mar 20, 2026, 4 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33498High 8.7
Parse Server: Query condition depth bypass via pre-validation transform pipeline
Affected: from 9.0.0, fixed in 9.6.0-alpha.44; fixed in 8.6.55.
Fixed in 8.6.55 (released Mar 20, 2026, 4 days before disclosure) and 9.6.0-alpha.44 (released Mar 20, 2026, 4 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33429Medium 6.3
Parse Server: Protected field change detection oracle via LiveQuery watch parameter
Affected: from 9.0.0, fixed in 9.6.0-alpha.43; fixed in 8.6.54.
Fixed in 8.6.54 (released Mar 20, 2026, 4 days before disclosure) and 9.6.0-alpha.43 (released Mar 20, 2026, 4 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33421High 7.1
Parse Server: LiveQuery bypasses CLP pointer permission enforcement
Affected: from 9.0.0, fixed in 9.6.0-alpha.42; fixed in 8.6.53.
Fixed in 8.6.53 (released Mar 20, 2026, 4 days before disclosure) and 9.6.0-alpha.42 (released Mar 20, 2026, 4 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33409High 7.0
Parse Server: Auth provider validation bypass on login via partial authData
Affected: from 9.0.0, fixed in 9.6.0-alpha.41; fixed in 8.6.52.
Fixed in 8.6.52 (released Mar 19, 2026, 5 days before disclosure) and 9.6.0-alpha.41 (released Mar 19, 2026, 5 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33323Medium 6.3
Parse Server: Email verification resend page leaks user existence
Affected: from 9.0.0, fixed in 9.6.0-alpha.40; fixed in 8.6.51.
Fixed in 8.6.51 (released Mar 19, 2026, 5 days before disclosure) and 9.6.0-alpha.40 (released Mar 19, 2026, 5 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (28K).
CVE-2026-33163High 8.2
Parse Server leaks protected fields via LiveQuery afterEvent trigger
Affected: from 9.0.0, fixed in 9.6.0-alpha.35; fixed in 8.6.50.
Fixed in 8.6.50 (released Mar 17, 2026, 1 day before disclosure) and 9.6.0-alpha.35 (released Mar 17, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (27.9K).
CVE-2026-33042Medium 6.9
Parse Server affected by empty authData bypassing credential requirement on signup
Affected: from 9.0.0, fixed in 9.6.0-alpha.29; fixed in 8.6.49.
Fixed in 8.6.49 (released Mar 16, 2026, 2 days before disclosure) and 9.6.0-alpha.29 (released Mar 16, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (27.9K).
CVE-2026-32944High 8.7
Parse Server crash via deeply nested query condition operators
Affected: from 9.0.0, fixed in 9.6.0-alpha.21; fixed in 8.6.45.
Fixed in 8.6.45 (released Mar 15, 2026, 3 days before disclosure) and 9.6.0-alpha.21 (released Mar 15, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (27.9K).
CVE-2026-32943Low 2.3
Parse Server has a password reset token single-use bypass via concurrent requests
Affected: from 9.0.0, fixed in 9.6.0-alpha.28; fixed in 8.6.48.
Fixed in 8.6.48 (released Mar 16, 2026, 2 days before disclosure) and 9.6.0-alpha.28 (released Mar 16, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (27.9K).
CVE-2026-32886High 8.2
Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Affected: from 9.0.0, fixed in 9.6.0-alpha.24; fixed in 8.6.47.
Fixed in 8.6.47 (released Mar 15, 2026, 3 days before disclosure) and 9.6.0-alpha.24 (released Mar 15, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (27.9K).
CVE-2026-32878Medium 5.3
Parse Server vulnerable to schema poisoning via prototype pollution in deep copy
Affected: from 9.0.0, fixed in 9.6.0-alpha.20; fixed in 8.6.44.
Fixed in 8.6.44 (released Mar 14, 2026, 4 days before disclosure) and 9.6.0-alpha.20 (released Mar 14, 2026, 4 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (27.9K).
CVE-2026-32770Medium 5.9
Parse Server: LiveQuery subscription with invalid regular expression crashes server
Affected: from 9.0.0, fixed in 9.6.0-alpha.19; fixed in 8.6.43.
Fixed in 8.6.43 (released Mar 14, 2026, 4 days before disclosure) and 9.6.0-alpha.19 (released Mar 14, 2026, 4 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (27.9K).
CVE-2026-32742Medium 4.3
Parse Server session creation endpoint allows overwriting server-generated session fields
Affected: from 9.0.0, fixed in 9.6.0-alpha.17; fixed in 8.6.42.
Fixed in 8.6.42 (released Mar 13, 2026, 5 days before disclosure) and 9.6.0-alpha.17 (released Mar 13, 2026, 5 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (27.9K).
CVE-2026-32728High 8.3
Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
Affected: from 9.0.0, fixed in 9.6.0-alpha.15; fixed in 8.6.41.
Fixed in 8.6.41 (released Mar 13, 2026, 5 days before disclosure) and 9.6.0-alpha.15 (released Mar 13, 2026, 5 days before disclosure).
The latest release, 9.11.0, is not affected.
42% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-32594Medium 6.9
Parse Server GraphQL WebSocket endpoint bypasses security middleware
Affected: from 9.0.0, fixed in 9.6.0-alpha.14; fixed in 8.6.40.
Fixed in 8.6.40 (released Mar 12, 2026, 1 day before disclosure) and 9.6.0-alpha.14 (released Mar 12, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-32269Medium 6.3
Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint
Affected: from 9.0.0, fixed in 9.6.0-alpha.13; from 8.0.2, fixed in 8.6.39.
Fixed in 8.6.39 (released Mar 11, 2026, 1 day before disclosure) and 9.6.0-alpha.13 (released Mar 11, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
6.8% of parse-server downloads last week were affected versions (4.5K).
CVE-2026-32248Critical 9.3
Parse Server: Account takeover via operator injection in authentication data identifier
Affected: from 9.0.0, fixed in 9.6.0-alpha.12; fixed in 8.6.38.
Fixed in 8.6.38 (released Mar 11, 2026, 1 day before disclosure) and 9.6.0-alpha.12 (released Mar 11, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-32242Critical 9.1
Parse Server OAuth2 adapter shares mutable state across providers via singleton instance
Affected: from 9.0.0, fixed in 9.6.0-alpha.11; fixed in 8.6.37.
Fixed in 8.6.37 (released Mar 11, 2026, 1 day before disclosure) and 9.6.0-alpha.11 (released Mar 11, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-32234Medium 5.1
Parse Server has a SQL injection via query field name when using PostgreSQL
Affected: from 9.0.0, fixed in 9.6.0-alpha.10; fixed in 8.6.36.
Fixed in 8.6.36 (released Mar 11, 2026, the day of disclosure) and 9.6.0-alpha.10 (released Mar 11, 2026, the day of disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-32098Medium 6.9
Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause
Affected: from 9.0.0, fixed in 9.6.0-alpha.9; fixed in 8.6.35.
Fixed in 8.6.35 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.9 (released Mar 10, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-31901Medium 6.3
Parse Server has user enumeration via email verification endpoint
Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.8; fixed in 8.6.34.
Fixed in 8.6.34 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.8 (released Mar 10, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-31875High 8.2
Parse Server MFA recovery codes not consumed after use
Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.7; fixed in 8.6.33.
Fixed in 8.6.33 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.7 (released Mar 10, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-31872High 8.7
Parse Server has a protected fields bypass via dot-notation in query and sort
Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.6; fixed in 8.6.32.
Fixed in 8.6.32 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.6 (released Mar 10, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-31871Critical 9.3
Parse Server has a SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.5; fixed in 8.6.31.
Fixed in 8.6.31 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.5 (released Mar 10, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.8K).
CVE-2026-31868Medium 6.3
Parse Server has Stored XSS via file upload of HTML-renderable file types
Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.4; fixed in 8.6.30.
Fixed in 8.6.30 (released Mar 9, 2026, 2 days before disclosure) and 9.6.0-alpha.4 (released Mar 9, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.7K).
CVE-2026-31856Critical 9.3
Parse Server has a SQL injection via `Increment` operation on nested object field in PostgreSQL
Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.3; fixed in 8.6.29.
Fixed in 8.6.29 (released Mar 9, 2026, 2 days before disclosure) and 9.6.0-alpha.3 (released Mar 9, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.7K).
CVE-2026-31840Critical 9.3
Parse Server has a SQL injection via dot-notation field name in PostgreSQL
Affected: from 9.0.0, fixed in 9.6.0-alpha.2; fixed in 8.6.28.
Fixed in 8.6.28 (released Mar 9, 2026, 2 days before disclosure) and 9.6.0-alpha.2 (released Mar 9, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.7K).
CVE-2026-31828Medium 6.0
Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction
Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.13; fixed in 8.6.26.
Fixed in 8.6.26 (released Mar 9, 2026, 1 day before disclosure) and 9.5.2-alpha.13 (released Mar 9, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.7K).
CVE-2026-31800High 8.8
Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.12; fixed in 8.6.25.
Fixed in 8.6.25 (released Mar 9, 2026, 1 day before disclosure) and 9.5.2-alpha.12 (released Mar 9, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.6K).
CVE-2026-30972Medium 6.9
Parse Server has a rate limit bypass via batch request endpoint
Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.10; fixed in 8.6.23.
Fixed in 8.6.23 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.10 (released Mar 8, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.6K).
CVE-2026-30967High 7.6
Parse Server OAuth2 authentication adapter account takeover via identity spoofing
Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.9; fixed in 8.6.22.
Fixed in 8.6.22 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.9 (released Mar 8, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.6K).
CVE-2026-30966Critical 10.0
Parse Server role escalation and CLP bypass via direct `_Join` table write
Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.7; fixed in 8.6.20.
Fixed in 8.6.20 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.7 (released Mar 8, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.6K).
CVE-2026-30965Critical 9.9
Parse Server session token exfiltration via `redirectClassNameForKey` query parameter
Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.8; fixed in 8.6.21.
Fixed in 8.6.21 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.8 (released Mar 8, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.6K).
CVE-2026-30962High 7.1
Parse Server has a protected fields bypass via logical query operators
Affected: from 9.0.0, fixed in 9.5.2-alpha.6; fixed in 8.6.19.
Fixed in 8.6.19 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.6 (released Mar 8, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.6K).
CVE-2026-30949High 7.6
Parse Server is missing audience validation in Keycloak authentication adapter
Affected: from 9.0.0, fixed in 9.5.2-alpha.5; fixed in 8.6.18.
Fixed in 8.6.18 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.5 (released Mar 8, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.5K).
CVE-2026-30948High 8.3
Parse Server has stored cross-site scripting (XSS) via SVG file upload
Affected: from 9.0.0, fixed in 9.5.2-alpha.4; fixed in 8.6.17.
Fixed in 8.6.17 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.4 (released Mar 8, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.5K).
CVE-2026-30947High 8.7
Parse Server ha a bypass of class-level permissions in LiveQuery
Affected: from 9.0.0, fixed in 9.5.2-alpha.3; fixed in 8.6.16.
Fixed in 8.6.16 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.3 (released Mar 8, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.5K).
CVE-2026-30946High 8.7
Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
Affected: fixed in 8.6.15; from 9.0.0, fixed in 9.5.2-alpha.2.
Fixed in 8.6.15 (released Mar 7, 2026, 3 days before disclosure) and 9.5.2-alpha.2 (released Mar 7, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.5K).
CVE-2026-30941High 8.7
Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
Affected: from 9.0.0, fixed in 9.5.2-alpha.1; fixed in 8.6.14.
Fixed in 8.6.14 (released Mar 7, 2026, 3 days before disclosure) and 9.5.2-alpha.1 (released Mar 7, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.5K).
CVE-2026-30939High 8.8
Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
Affected: fixed in 8.6.13; from 9.0.0-alpha.1, fixed in 9.5.1-alpha.2.
Fixed in 8.6.13 (released Mar 7, 2026, 3 days before disclosure) and 9.5.1-alpha.2 (released Mar 7, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.4K).
CVE-2026-30938Medium 6.9
Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement
Affected: fixed in 8.6.12; from 9.0.0-alpha.1, fixed in 9.5.1-alpha.1.
Fixed in 8.6.12 (released Mar 7, 2026, 3 days before disclosure) and 9.5.1-alpha.1 (released Mar 7, 2026, 3 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.4K).
CVE-2026-30925High 8.2
Parse Server affected by Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
Affected: from 9.0.0-alpha.1, fixed in 9.5.0-alpha.14; fixed in 8.6.11.
Fixed in 8.6.11 (released Mar 7, 2026, 2 days before disclosure) and 9.5.0-alpha.14 (released Mar 7, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.4K).
CVE-2026-30854Medium 6.9
Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled
Affected: from 9.3.1-alpha.3, fixed in 9.5.0-alpha.10.
Fixed in 9.5.0-alpha.10 (released Mar 6, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
0.8% of parse-server downloads last week were affected versions (517).
CVE-2026-30850Medium 6.3
Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization
Affected: fixed in 8.6.9; from 9.0.0-alpha.1, fixed in 9.5.0-alpha.9.
Fixed in 8.6.9 (released Mar 6, 2026, 1 day before disclosure) and 9.5.0-alpha.9 (released Mar 6, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.3K).
CVE-2026-30848Medium 6.3
Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory
Affected: fixed in 8.6.8; from 9.0.0-alpha.1, fixed in 9.5.0-alpha.8.
Fixed in 8.6.8 (released Mar 5, 2026, 2 days before disclosure) and 9.5.0-alpha.8 (released Mar 5, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.3K).
CVE-2026-30863Critical 9.3
Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
Affected: from 9.0.0-alpha.1, fixed in 9.5.0-alpha.11; fixed in 8.6.10.
Fixed in 8.6.10 (released Mar 6, 2026, 1 day before disclosure) and 9.5.0-alpha.11 (released Mar 6, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.3K).
CVE-2026-30835Medium 6.9
Parse Server: Malformed `$regex` query leaks database error details in API response
Affected: from 9.0.0, fixed in 9.5.0-alpha.6; fixed in 8.6.7.
Fixed in 8.6.7 (released Mar 5, 2026, 1 day before disclosure) and 9.5.0-alpha.6 (released Mar 5, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.2K).
CVE-2026-30229High 8.5
Parse Server: Endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
Affected: fixed in 8.6.6; from 9.0.0, fixed in 9.5.0-alpha.4.
Fixed in 8.6.6 (released Mar 5, 2026, 1 day before disclosure) and 9.5.0-alpha.4 (released Mar 5, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.2K).
CVE-2026-30228Medium 6.9
Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction
Affected: from 9.0.0, fixed in 9.5.0-alpha.3; fixed in 8.6.5.
Fixed in 8.6.5 (released Mar 5, 2026, 1 day before disclosure) and 9.5.0-alpha.3 (released Mar 5, 2026, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
41% of parse-server downloads last week were affected versions (27.2K).
CVE-2026-29182High 8.6
Parse Server: Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
Affected: from 9.0.0, fixed in 9.4.1-alpha.3; fixed in 8.6.4.
Fixed in 8.6.4 (released Mar 4, 2026, 2 days before disclosure) and 9.4.1-alpha.3 (released Mar 4, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
40% of parse-server downloads last week were affected versions (27.1K).
CVE-2026-27804Critical 9.3
Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
Affected: from 9.0.0, fixed in 9.3.1-alpha.4; fixed in 8.6.3.
Fixed in 8.6.3 (released Feb 23, 2026, 2 days before disclosure) and 9.3.1-alpha.4 (released Feb 23, 2026, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
40% of parse-server downloads last week were affected versions (26.7K).
CVE-2025-68150High 8.3
Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter
Affected: from 9.0.0, fixed in 9.1.1-alpha.1; fixed in 8.6.2.
Fixed in 8.6.2 (released Dec 16, 2025, the day of disclosure) and 9.1.1-alpha.1 (released Dec 16, 2025, the day of disclosure).
The latest release, 9.11.0, is not affected.
39% of parse-server downloads last week were affected versions (26.4K).
CVE-2025-68115Medium 5.3
Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables
Affected: fixed in 8.6.1; from 9.0.0, fixed in 9.1.0-alpha.3.
Fixed in 8.6.1 (released Dec 14, 2025, 2 days before disclosure) and 9.1.0-alpha.3 (released Dec 14, 2025, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
39% of parse-server downloads last week were affected versions (26.4K).
CVE-2025-64502Medium 6.9
Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details
Affected: fixed in 8.5.0-alpha.5.
Fixed in 8.5.0-alpha.5 (released Nov 8, 2025, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
39% of parse-server downloads last week were affected versions (26.1K).
CVE-2025-64430High 7.5
Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
Affected: from 4.2.0, fixed in 7.5.4; from 8.0.0, fixed in 8.4.0-alpha.2.
Fixed in 7.5.4 (released Nov 5, 2025, 2 days before disclosure) and 8.4.0-alpha.2 (released Nov 5, 2025, 2 days before disclosure).
The latest release, 9.11.0, is not affected.
29% of parse-server downloads last week were affected versions (19.3K).
CVE-2025-53364Medium 5.3
Parse Server exposes the data schema via GraphQL API
Affected: from 8.0.0, fixed in 8.2.2; from 5.3.0, fixed in 7.5.3.
Fixed in 7.5.3 (released Jul 10, 2025, the day of disclosure) and 8.2.2 (released Jul 10, 2025, the day of disclosure).
The latest release, 9.11.0, is not affected.
20% of parse-server downloads last week were affected versions (13.2K).
CVE-2025-30168Medium 6.9
Parse Server has an OAuth login vulnerability
Affected: fixed in 7.5.2; from 8.0.0, fixed in 8.0.2.
Fixed in 7.5.2 (released Mar 21, 2025, the day of disclosure) and 8.0.2 (released Mar 21, 2025, the day of disclosure).
The latest release, 9.11.0, is not affected.
28% of parse-server downloads last week were affected versions (18.7K).
CVE-2024-47183High 8.1
Parse Server's custom object ID allows to acquire role privileges
Affected: fixed in 6.5.9; from 7.0.0, fixed in 7.3.0.
Fixed in 6.5.9 and 7.3.0 (released Oct 3, 2024, 1 day before disclosure).
The latest release, 9.11.0, is not affected.
22% of parse-server downloads last week were affected versions (14.9K).
CVE-2024-39309Critical 9.8
ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
Affected: fixed in 6.5.7; from 7.0.0, fixed in 7.1.0.
Fixed in 6.5.7 and 7.3.0 (released Oct 3, 2024, 94 days after disclosure, the advisory names 7.1.0, which was never published).
The latest release, 9.11.0, is not affected.
16% of parse-server downloads last week were affected versions (10.4K).
CVE-2024-29027Critical 9.1
Parse Server crash and RCE via invalid Cloud Function or Cloud Job name
Affected: fixed in 6.5.5; from 7.0.0-alpha.1, fixed in 7.0.0-alpha.29.
Fixed in 6.5.5 and 7.3.0 (released Oct 3, 2024, 198 days after disclosure, the advisory names 7.0.0-alpha.29, which was never published).
The latest release, 9.11.0, is not affected.
15% of parse-server downloads last week were affected versions (10K).
CVE-2024-27298Critical 10.0
Parse Server literalizeRegexPart SQL Injection
Affected: fixed in 6.5.0; from 7.0.0-alpha.1, fixed in 7.0.0-alpha.20.
Fixed in 6.5.0 and 7.3.0 (released Oct 3, 2024, 216 days after disclosure, the advisory names 7.0.0-alpha.20, which was never published).
The latest release, 9.11.0, is not affected.
15% of parse-server downloads last week were affected versions (9.9K).
CVE-2023-46119High 7.5
Parse Server may crash when uploading file without extension
Affected: from 1.0.0, fixed in 5.5.6; from 6.0.0, fixed in 6.3.1.
Fixed in 5.5.6 and 6.3.1.
The latest release, 9.11.0, is not affected.
12% of parse-server downloads last week were affected versions (8K).
CVE-2023-41058High 7.5
Trigger `beforeFind` not invoked in internal query pipeline in parse-server
Affected: from 1.0.0, fixed in 5.5.5; from 6.0.0, fixed in 6.2.2.
Fixed in 5.5.5 and 6.2.2.
The latest release, 9.11.0, is not affected.
12% of parse-server downloads last week were affected versions (7.8K).
CVE-2023-36475Critical 9.8
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Affected: fixed in 5.5.2; from 6.0.0, fixed in 6.2.1.
Fixed in 5.5.2 and 6.2.1.
The latest release, 9.11.0, is not affected.
11% of parse-server downloads last week were affected versions (7.6K).
CVE-2023-32689Medium 6.3
Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file
Affected: fixed in 5.4.4; from 6.0.0, fixed in 6.1.1.
Fixed in 5.4.4 and 6.1.1.
The latest release, 9.11.0, is not affected.
11% of parse-server downloads last week were affected versions (7.6K).
CVE-2023-22474High 8.7
Parse Server is vulnerable to authentication bypass via spoofing
Affected: fixed in 5.4.1.
Fixed in 5.4.1.
The latest release, 9.11.0, is not affected.
11% of parse-server downloads last week were affected versions (7.2K).
CVE-2022-41879High 7.2
Parse Server subject to Prototype pollution via Cloud Code Webhooks
Affected: fixed in 4.10.20; from 5.0.0, fixed in 5.3.3.
Fixed in 4.10.20 and 5.3.3.
The latest release, 9.11.0, is not affected.
10% of parse-server downloads last week were affected versions (6.7K).
CVE-2022-41878High 7.2
Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers
Affected: fixed in 4.10.19; from 5.0.0, fixed in 5.3.2.
Fixed in 4.10.19 and 5.3.2.
The latest release, 9.11.0, is not affected.
10% of parse-server downloads last week were affected versions (6.7K).
CVE-2022-39396Critical 9.8
Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser
Affected: fixed in 4.10.18; from 5.0.0, fixed in 5.3.1.
Fixed in 4.10.18 and 5.3.1.
The latest release, 9.11.0, is not affected.
10% of parse-server downloads last week were affected versions (6.7K).
CVE-2022-39313High 7.5
Parse Server crashes when receiving file download request with invalid byte range
Affected: fixed in 4.10.17; from 5.0.0, fixed in 5.2.8.
Fixed in 4.10.17 and 5.2.8.
The latest release, 9.11.0, is not affected.
7.3% of parse-server downloads last week were affected versions (4.9K).
CVE-2022-39231Low 3.7
Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented
Affected: fixed in 4.10.16; from 5.0.0, fixed in 5.2.7.
Fixed in 4.10.16 and 5.2.7.
The latest release, 9.11.0, is not affected.
7.3% of parse-server downloads last week were affected versions (4.9K).
CVE-2022-39225Medium 4.3
Parse Server subject to Incorrect Resource Transfer Between Spheres
Affected: fixed in 4.10.15; from 5.0.0, fixed in 5.2.6.
Fixed in 4.10.15 and 5.2.6.
The latest release, 9.11.0, is not affected.
7.3% of parse-server downloads last week were affected versions (4.9K).
CVE-2022-36079High 8.6
Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
Affected: fixed in 4.10.14; from 5.0.0, fixed in 5.2.5.
Fixed in 4.10.14 and 5.2.5.
The latest release, 9.11.0, is not affected.
7.3% of parse-server downloads last week were affected versions (4.9K).
CVE-2022-31112High 8.2
Protected fields exposed via LiveQuery in parse-server
Affected: fixed in 4.10.13; from 5.0.0, fixed in 5.2.4.
Fixed in 4.10.13 and 5.2.4.
The latest release, 9.11.0, is not affected.
7.2% of parse-server downloads last week were affected versions (4.8K).
CVE-2022-31089High 7.5
Invalid file request can crashe parse-server
Affected: fixed in 4.10.12; from 5.0.0, fixed in 5.2.3.
Fixed in 4.10.12 and 5.2.3.
The latest release, 9.11.0, is not affected.
7.2% of parse-server downloads last week were affected versions (4.8K).
CVE-2022-31083High 8.6
Authentication bypass in Parse Server Apple Game Center auth adapter
Affected: fixed in 4.10.11; from 5.0.0, fixed in 5.2.2.
Fixed in 4.10.11 and 5.2.2.
The latest release, 9.11.0, is not affected.
7.2% of parse-server downloads last week were affected versions (4.8K).
CVE-2022-24901High 7.5
Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
Affected: fixed in 4.10.10; from 5.0.0, fixed in 5.2.1.
Fixed in 4.10.10 and 5.2.1.
The latest release, 9.11.0, is not affected.
7.1% of parse-server downloads last week were affected versions (4.8K).
CVE-2022-24760Critical 10.0
Command Injection in Parse server
Affected: fixed in 4.10.7.
Fixed in 4.10.7.
The latest release, 9.11.0, is not affected.
6.8% of parse-server downloads last week were affected versions (4.5K).
CVE-2021-41109High 7.5
LiveQuery publishes user session tokens
Affected: fixed in 4.10.4.
Fixed in 4.10.4.
The latest release, 9.11.0, is not affected.
6.7% of parse-server downloads last week were affected versions (4.5K).
CVE-2021-39187High 7.5
Crash server with query parameter
Affected: fixed in 4.10.3.
Fixed in 4.10.3.
The latest release, 9.11.0, is not affected.
6.7% of parse-server downloads last week were affected versions (4.5K).
CVE-2021-39138Medium 4.8
New anonymous user session acts as if it's created with password
Affected: fixed in 4.5.2.
Fixed in 4.5.2.
The latest release, 9.11.0, is not affected.
6.7% of parse-server downloads last week were affected versions (4.5K).
CVE-2020-26288High 7.7
Parse Server stores password in plain text
Affected: fixed in 4.5.0.
Fixed in 4.5.0.
The latest release, 9.11.0, is not affected.
6.2% of parse-server downloads last week were affected versions (4.2K).
CVE-2020-15270Medium 4.3
Improper session expiration in Parse Server
Affected: fixed in 4.4.0.
Fixed in 4.4.0.
The latest release, 9.11.0, is not affected.
6.1% of parse-server downloads last week were affected versions (4.1K).
CVE-2020-15126Medium 6.5
Information disclosure through Viewer query in parse-server
Affected: from 3.5.0, fixed in 4.3.0.
Fixed in 4.3.0.
The latest release, 9.11.0, is not affected.
3.4% of parse-server downloads last week were affected versions (2.3K).
CVE-2020-5251High 7.7
Information disclosure in parse-server
Affected: fixed in 4.1.0.
Fixed in 4.1.0.
The latest release, 9.11.0, is not affected.
5.8% of parse-server downloads last week were affected versions (3.9K).
CVE-2019-1020013Unrated
parse-server before 3.6.0 allows account enumeration.
Affected: fixed in 3.6.0.
Fixed in 3.6.0.
The latest release, 9.11.0, is not affected.
2.6% of parse-server downloads last week were affected versions (1.8K).
CVE-2019-1020012Unrated
parse-server before 3.4.1 allows DoS after any POST to a volatile class.
Affected: fixed in 3.4.1.
Fixed in 3.4.1.
The latest release, 9.11.0, is not affected.
2.6% of parse-server downloads last week were affected versions (1.7K).