# parse-server (npm) vulnerabilities

118 known vulnerabilities (16 critical, 51 high, 39 medium, 10 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 9.11.0 (Nov 3, 2026): no advisory affects it
- Newest unaffected release: 9.11.0 (Nov 3, 2026), the latest release
- Weekly downloads: 81.6K
- Dependents: 4
- Releases: 500+ since 6.5.10 (Oct 12, 2024)
- Registry: https://www.npmjs.com/package/parse-server
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-61448: 6.5.10 to 8.6.83 (8.6.84 is outside it); 9.0.0 to 9.10.0-alpha.1 (9.10.0-alpha.2 is outside it)
- CVE-2026-57481: 6.5.10 to 8.6.82 (8.6.83 is outside it); 9.0.0 to 9.9.1-alpha.12 (9.9.1-alpha.13 is outside it)
- CVE-2026-57480: 6.5.10 to 8.6.81 (8.6.82 is outside it); 9.0.0 to 9.9.1-alpha.11 (9.9.1-alpha.12 is outside it)
- CVE-2026-55778: 6.5.10 to 8.6.80 (8.6.81 is outside it); 9.0.0 to 9.9.1-alpha.10 (9.9.1-alpha.11 is outside it)
- CVE-2021-47987: no published release is affected
- CVE-2021-47986: no published release is affected
- CVE-2026-53726: 6.5.10 to 8.6.79 (8.6.80 is outside it); 9.0.0 to 9.9.1-alpha.5 (9.9.1-alpha.6 is outside it)
- CVE-2026-53725: 9.8.0 to 9.9.1-alpha.4 (9.9.1-alpha.5 is outside it)
- CVE-2026-53724: 6.5.10 to 8.6.78 (8.6.79 is outside it); 9.0.0 to 9.9.1-alpha.3 (9.9.1-alpha.4 is outside it)
- CVE-2026-50008: 9.8.0 to 9.9.1-alpha.2 (9.9.1-alpha.3 is outside it)
- CVE-2026-47138: 6.5.10 to 8.6.76 (8.6.77 is outside it); 9.0.0 to 9.9.0 (9.9.1-alpha.1 is outside it)
- CVE-2026-47248: 6.5.10 to 8.6.77 (8.6.78 is outside it); 9.0.0 to 9.9.1-alpha.1 (9.9.1-alpha.2 is outside it)
- CVE-2026-43930: 6.5.10 to 8.6.75 (8.6.76 is outside it); 9.0.0 to 9.9.0-alpha.1 (9.9.0-alpha.2 is outside it)
- CVE-2026-39381: 7.3.0 to 8.6.74 (8.6.75 is outside it); 9.0.0 to 9.8.0-alpha.6 (9.8.0-alpha.7 is outside it)
- CVE-2026-39321: 6.5.10 to 8.6.73 (8.6.74 is outside it); 9.0.0 to 9.8.0-alpha.5 (9.8.0-alpha.6 is outside it)
- CVE-2026-35200: 6.5.10 to 8.6.72 (8.6.73 is outside it); 9.0.0 to 9.7.1-alpha.3 (9.7.1-alpha.4 is outside it)
- CVE-2026-34784: 6.5.10 to 8.6.70 (8.6.71 is outside it); 9.0.0 to 9.7.0 (9.7.1-alpha.1 is outside it)
- CVE-2026-34215: 6.5.10 to 8.6.62 (8.6.63 is outside it); 9.0.0 to 9.7.0-alpha.6 (9.7.0-alpha.7 is outside it)
- CVE-2026-34595: 6.5.10 to 8.6.69 (8.6.70 is outside it); 9.0.0 to 9.7.0-alpha.15 (9.7.0-alpha.16 is outside it)
- CVE-2026-34574: 6.5.10 to 8.6.68 (8.6.69 is outside it); 9.0.0 to 9.7.0-alpha.13 (9.7.0-alpha.14 is outside it)
- CVE-2026-34573: 6.5.10 to 8.6.67 (8.6.68 is outside it); 9.0.0 to 9.7.0-alpha.11 (9.7.0-alpha.12 is outside it)
- CVE-2026-34532: 6.5.10 to 8.6.66 (8.6.67 is outside it); 9.0.0 to 9.7.0-alpha.10 (9.7.0-alpha.11 is outside it)
- CVE-2026-34373: 6.5.10 to 8.6.65 (8.6.66 is outside it); 9.0.0 to 9.7.0-alpha.9 (9.7.0-alpha.10 is outside it)
- CVE-2026-34363: 6.5.10 to 8.6.64 (8.6.65 is outside it); 9.0.0 to 9.7.0-alpha.8 (9.7.0-alpha.9 is outside it)
- CVE-2026-34224: 6.5.10 to 8.6.63 (8.6.64 is outside it); 9.0.0 to 9.7.0-alpha.7 (9.7.0-alpha.8 is outside it)
- CVE-2026-33627: 6.5.10 to 8.6.60 (8.6.61 is outside it); 9.0.0 to 9.6.0-alpha.54 (9.6.0-alpha.55 is outside it)
- CVE-2026-33624: 6.5.10 to 8.6.59 (8.6.60 is outside it); 9.0.0 to 9.6.0-alpha.53 (9.6.0-alpha.54 is outside it)
- CVE-2026-33539: 6.5.10 to 8.6.58 (8.6.59 is outside it); 9.0.0 to 9.6.0-alpha.52 (9.6.0-alpha.53 is outside it)
- CVE-2026-33538: 6.5.10 to 8.6.57 (8.6.58 is outside it); 9.0.0 to 9.6.0-alpha.51 (9.6.0-alpha.52 is outside it)
- CVE-2026-33527: 6.5.10 to 8.6.56 (8.6.57 is outside it); 9.0.0 to 9.6.0-alpha.47 (9.6.0-alpha.48 is outside it)
- CVE-2026-33508: 6.5.10 to 8.6.55 (8.6.56 is outside it); 9.0.0 to 9.6.0-alpha.44 (9.6.0-alpha.45 is outside it)
- CVE-2026-33498: 6.5.10 to 8.6.54 (8.6.55 is outside it); 9.0.0 to 9.6.0-alpha.43 (9.6.0-alpha.44 is outside it)
- CVE-2026-33429: 6.5.10 to 8.6.53 (8.6.54 is outside it); 9.0.0 to 9.6.0-alpha.42 (9.6.0-alpha.43 is outside it)
- CVE-2026-33421: 6.5.10 to 8.6.52 (8.6.53 is outside it); 9.0.0 to 9.6.0-alpha.41 (9.6.0-alpha.42 is outside it)
- CVE-2026-33409: 6.5.10 to 8.6.51 (8.6.52 is outside it); 9.0.0 to 9.6.0-alpha.40 (9.6.0-alpha.41 is outside it)
- CVE-2026-33323: 6.5.10 to 8.6.50 (8.6.51 is outside it); 9.0.0 to 9.6.0-alpha.39 (9.6.0-alpha.40 is outside it)
- CVE-2026-33163: 6.5.10 to 8.6.49 (8.6.50 is outside it); 9.0.0 to 9.6.0-alpha.34 (9.6.0-alpha.35 is outside it)
- CVE-2026-33042: 6.5.10 to 8.6.48 (8.6.49 is outside it); 9.0.0 to 9.6.0-alpha.28 (9.6.0-alpha.29 is outside it)
- CVE-2026-32944: 6.5.10 to 8.6.44 (8.6.45 is outside it); 9.0.0 to 9.6.0-alpha.20 (9.6.0-alpha.21 is outside it)
- CVE-2026-32943: 6.5.10 to 8.6.47 (8.6.48 is outside it); 9.0.0 to 9.6.0-alpha.27 (9.6.0-alpha.28 is outside it)
- CVE-2026-32886: 6.5.10 to 8.6.46 (8.6.47 is outside it); 9.0.0 to 9.6.0-alpha.23 (9.6.0-alpha.24 is outside it)
- CVE-2026-32878: 6.5.10 to 8.6.43 (8.6.44 is outside it); 9.0.0 to 9.6.0-alpha.19 (9.6.0-alpha.20 is outside it)
- CVE-2026-32770: 6.5.10 to 8.6.42 (8.6.43 is outside it); 9.0.0 to 9.6.0-alpha.18 (9.6.0-alpha.19 is outside it)
- CVE-2026-32742: 6.5.10 to 8.6.41 (8.6.42 is outside it); 9.0.0 to 9.6.0-alpha.16 (9.6.0-alpha.17 is outside it)
- CVE-2026-32728: 6.5.10 to 8.6.40 (8.6.41 is outside it); 9.0.0 to 9.6.0-alpha.14 (9.6.0-alpha.15 is outside it)
- CVE-2026-32594: 6.5.10 to 8.6.39 (8.6.40 is outside it); 9.0.0 to 9.6.0-alpha.13 (9.6.0-alpha.14 is outside it)
- CVE-2026-32269: 8.0.2 to 8.6.38 (8.6.39 is outside it); 9.0.0 to 9.6.0-alpha.12 (9.6.0-alpha.13 is outside it)
- CVE-2026-32248: 6.5.10 to 8.6.37 (8.6.38 is outside it); 9.0.0 to 9.6.0-alpha.11 (9.6.0-alpha.12 is outside it)
- CVE-2026-32242: 6.5.10 to 8.6.36 (8.6.37 is outside it); 9.0.0 to 9.6.0-alpha.10 (9.6.0-alpha.11 is outside it)
- CVE-2026-32234: 6.5.10 to 8.6.35 (8.6.36 is outside it); 9.0.0 to 9.6.0-alpha.9 (9.6.0-alpha.10 is outside it)
- CVE-2026-32098: 6.5.10 to 8.6.34 (8.6.35 is outside it); 9.0.0 to 9.6.0-alpha.8 (9.6.0-alpha.9 is outside it)
- CVE-2026-31901: 6.5.10 to 8.6.33 (8.6.34 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.7 (9.6.0-alpha.8 is outside it)
- CVE-2026-31875: 6.5.10 to 8.6.32 (8.6.33 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.6 (9.6.0-alpha.7 is outside it)
- CVE-2026-31872: 6.5.10 to 8.6.31 (8.6.32 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.5 (9.6.0-alpha.6 is outside it)
- CVE-2026-31871: 6.5.10 to 8.6.30 (8.6.31 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.4 (9.6.0-alpha.5 is outside it)
- CVE-2026-31868: 6.5.10 to 8.6.29 (8.6.30 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.3 (9.6.0-alpha.4 is outside it)
- CVE-2026-31856: 6.5.10 to 8.6.28 (8.6.29 is outside it); 9.0.0-alpha.1 to 9.6.0-alpha.2 (9.6.0-alpha.3 is outside it)
- CVE-2026-31840: 6.5.10 to 8.6.27 (8.6.28 is outside it); 9.0.0 to 9.6.0-alpha.1 (9.6.0-alpha.2 is outside it)
- CVE-2026-31828: 6.5.10 to 8.6.25 (8.6.26 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.12 (9.5.2-alpha.13 is outside it)
- CVE-2026-31800: 6.5.10 to 8.6.24 (8.6.25 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.11 (9.5.2-alpha.12 is outside it)
- CVE-2026-30972: 6.5.10 to 8.6.22 (8.6.23 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.9 (9.5.2-alpha.10 is outside it)
- CVE-2026-30967: 6.5.10 to 8.6.21 (8.6.22 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.8 (9.5.2-alpha.9 is outside it)
- CVE-2026-30966: 6.5.10 to 8.6.19 (8.6.20 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.6 (9.5.2-alpha.7 is outside it)
- CVE-2026-30965: 6.5.10 to 8.6.20 (8.6.21 is outside it); 9.0.0-alpha.1 to 9.5.2-alpha.7 (9.5.2-alpha.8 is outside it)
- CVE-2026-30962: 6.5.10 to 8.6.18 (8.6.19 is outside it); 9.0.0 to 9.5.2-alpha.5 (9.5.2-alpha.6 is outside it)
- CVE-2026-30949: 6.5.10 to 8.6.17 (8.6.18 is outside it); 9.0.0 to 9.5.2-alpha.4 (9.5.2-alpha.5 is outside it)
- CVE-2026-30948: 6.5.10 to 8.6.16 (8.6.17 is outside it); 9.0.0 to 9.5.2-alpha.3 (9.5.2-alpha.4 is outside it)
- CVE-2026-30947: 6.5.10 to 8.6.15 (8.6.16 is outside it); 9.0.0 to 9.5.2-alpha.2 (9.5.2-alpha.3 is outside it)
- CVE-2026-30946: 6.5.10 to 8.6.14 (8.6.15 is outside it); 9.0.0 to 9.5.2-alpha.1 (9.5.2-alpha.2 is outside it)
- CVE-2026-30941: 6.5.10 to 8.6.13 (8.6.14 is outside it); 9.0.0 to 9.5.1 (9.5.2-alpha.1 is outside it)
- CVE-2026-30939: 6.5.10 to 8.6.12 (8.6.13 is outside it); 9.0.0-alpha.1 to 9.5.1-alpha.1 (9.5.1-alpha.2 is outside it)
- CVE-2026-30938: 6.5.10 to 8.6.11 (8.6.12 is outside it); 9.0.0-alpha.1 to 9.5.0 (9.5.1-alpha.1 is outside it)
- CVE-2026-30925: 6.5.10 to 8.6.10 (8.6.11 is outside it); 9.0.0-alpha.1 to 9.5.0-alpha.13 (9.5.0-alpha.14 is outside it)
- CVE-2026-30854: 9.3.1-alpha.3 to 9.5.0-alpha.9 (9.5.0-alpha.10 is outside it)
- CVE-2026-30850: 6.5.10 to 8.6.8 (8.6.9 is outside it); 9.0.0-alpha.1 to 9.5.0-alpha.8 (9.5.0-alpha.9 is outside it)
- CVE-2026-30848: 6.5.10 to 8.6.7 (8.6.8 is outside it); 9.0.0-alpha.1 to 9.5.0-alpha.7 (9.5.0-alpha.8 is outside it)
- CVE-2026-30863: 6.5.10 to 8.6.9 (8.6.10 is outside it); 9.0.0-alpha.1 to 9.5.0-alpha.10 (9.5.0-alpha.11 is outside it)
- CVE-2026-30835: 6.5.10 to 8.6.6 (8.6.7 is outside it); 9.0.0 to 9.5.0-alpha.5 (9.5.0-alpha.6 is outside it)
- CVE-2026-30229: 6.5.10 to 8.6.5 (8.6.6 is outside it); 9.0.0 to 9.5.0-alpha.3 (9.5.0-alpha.4 is outside it)
- CVE-2026-30228: 6.5.10 to 8.6.4 (8.6.5 is outside it); 9.0.0 to 9.5.0-alpha.2 (9.5.0-alpha.3 is outside it)
- CVE-2026-29182: 6.5.10 to 8.6.3 (8.6.4 is outside it); 9.0.0 to 9.4.1-alpha.2 (9.4.1-alpha.3 is outside it)
- CVE-2026-27804: 6.5.10 to 8.6.2 (8.6.3 is outside it); 9.0.0 to 9.3.1-alpha.3 (9.3.1-alpha.4 is outside it)
- CVE-2025-68150: 6.5.10 to 8.6.1 (8.6.2 is outside it); 9.0.0 to 9.1.0 (9.1.1-alpha.1 is outside it)
- CVE-2025-68115: 6.5.10 to 8.6.0 (8.6.1 is outside it); 9.0.0 to 9.1.0-alpha.2 (9.1.0-alpha.3 is outside it)
- CVE-2025-64502: 6.5.10 to 8.5.0-alpha.4 (8.5.0-alpha.5 is outside it)
- CVE-2025-64430: 6.5.10 to 7.5.3 (7.5.4 is outside it); 8.0.0 to 8.4.0-alpha.1 (8.4.0-alpha.2 is outside it)
- CVE-2025-53364: 6.5.10 to 7.5.2 (7.5.3 is outside it); 8.0.0 to 8.2.2-alpha.1 (8.2.2 is outside it)
- CVE-2025-30168: 6.5.10 to 7.5.1 (7.5.2 is outside it); 8.0.0 to 8.0.2-alpha.1 (8.0.2 is outside it)
- CVE-2024-47183: no published release is affected
- CVE-2024-39309: no published release is affected
- CVE-2024-29027: no published release is affected
- CVE-2024-27298: no published release is affected
- CVE-2023-46119: no published release is affected
- CVE-2023-41058: no published release is affected
- CVE-2023-36475: no published release is affected
- CVE-2023-32689: no published release is affected
- CVE-2023-22474: no published release is affected
- CVE-2022-41879: no published release is affected
- CVE-2022-41878: no published release is affected
- CVE-2022-39396: no published release is affected
- CVE-2022-39313: no published release is affected
- CVE-2022-39231: no published release is affected
- CVE-2022-39225: no published release is affected
- CVE-2022-36079: no published release is affected
- CVE-2022-31112: no published release is affected
- CVE-2022-31089: no published release is affected
- CVE-2022-31083: no published release is affected
- CVE-2022-24901: no published release is affected
- CVE-2022-24760: no published release is affected
- CVE-2021-41109: no published release is affected
- CVE-2021-39187: no published release is affected
- CVE-2021-39138: no published release is affected
- CVE-2020-26288: no published release is affected
- CVE-2020-15270: no published release is affected
- CVE-2020-15126: no published release is affected
- CVE-2020-5251: no published release is affected
- CVE-2019-1020013: no published release is affected
- CVE-2019-1020012: no published release is affected

Older releases aren't stored, so the earliest spans may start sooner.

## Advisories (118)

### [CVE-2026-61448](https://cve.now/CVE-2026-61448): Parse Server 9.0.0 Stored XSS via malformed Content-Type

- Severity: Low 2.1
- Published: Jul 11, 2026
- Affected: from 9.0.0, fixed in 9.10.0-alpha.2; fixed in 8.6.84.
- Fixed in 8.6.84 (released Jun 25, 2026, 16 days before disclosure) and 9.10.0-alpha.2 (released Jun 25, 2026, 16 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 47% of parse-server downloads last week were affected versions (31.2K).

### [CVE-2026-57481](https://cve.now/CVE-2026-57481): Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change

- Severity: Low 2.3
- Published: Jul 8, 2026
- Affected: from 9.0.0, fixed in 9.9.1-alpha.13; fixed in 8.6.83.
- Fixed in 8.6.83 (released Jun 19, 2026, 19 days before disclosure) and 9.9.1-alpha.13 (released Jun 19, 2026, 19 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 46% of parse-server downloads last week were affected versions (31.2K).

### [CVE-2026-57480](https://cve.now/CVE-2026-57480): Parse Server: Denial of service via exponential-time processing of deeply nested query operators

- Severity: High 8.7
- Published: Jul 8, 2026
- Affected: from 9.0.0, fixed in 9.9.1-alpha.12; fixed in 8.6.82.
- Fixed in 8.6.82 (released Jun 17, 2026, 21 days before disclosure) and 9.9.1-alpha.12 (released Jun 17, 2026, 21 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 46% of parse-server downloads last week were affected versions (31.1K).

### [CVE-2026-55778](https://cve.now/CVE-2026-55778): Parse Server: Stored XSS via non-standard file extension bypassing file upload extension blocklist

- Severity: Low 2.1
- Published: Jul 8, 2026
- Affected: from 9.0.0, fixed in 9.9.1-alpha.11; fixed in 8.6.81.
- Fixed in 8.6.81 (released Jun 16, 2026, 22 days before disclosure) and 9.9.1-alpha.11 (released Jun 16, 2026, 22 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 46% of parse-server downloads last week were affected versions (31.1K).

### [CVE-2021-47987](https://cve.now/CVE-2021-47987): Parse Server - Arbitrary Code Execution via Malicious Version Tags

- Severity: High 7.7
- Published: Jun 25, 2026
- Affected: from 4.0.0, fixed in 4.5.2; from 4.6.0, fixed in 4.10.0.
- Fixed in 4.5.2 and 4.10.0.
- The latest release, 9.11.0, is not affected.
- 0.8% of parse-server downloads last week were affected versions (547).

### [CVE-2021-47986](https://cve.now/CVE-2021-47986): Parse Server - Unreviewed Code Execution via Malicious Version Tags

- Severity: High 7.7
- Published: Jun 25, 2026
- Affected: from 4.0.0, fixed in 4.5.2; from 4.6.0, fixed in 4.10.0.
- Fixed in 4.5.2 and 4.10.0.
- The latest release, 9.11.0, is not affected.
- 0.8% of parse-server downloads last week were affected versions (547).

### [CVE-2026-53726](https://cve.now/CVE-2026-53726): Parse Server: Relation \`$relatedTo\` query bypasses \`protectedFields\` and owning-object ACL

- Severity: Medium 6.9
- Published: Jun 12, 2026
- Affected: from 9.0.0, fixed in 9.9.1-alpha.6; fixed in 8.6.80.
- Fixed in 8.6.80 (released Jun 3, 2026, 9 days before disclosure) and 9.9.1-alpha.6 (released Jun 3, 2026, 9 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 46% of parse-server downloads last week were affected versions (31.1K).

### [CVE-2026-53725](https://cve.now/CVE-2026-53725): Parse Server: Endpoints \`/login\` and \`/verifyPassword\` disclose MFA secrets and protected fields when \`\_User\` get is denied

- Severity: Medium 5.9
- Published: Jun 12, 2026
- Affected: from 9.8.0, fixed in 9.9.1-alpha.5.
- Fixed in 9.9.1-alpha.5 (released Jun 3, 2026, 9 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 2% of parse-server downloads last week were affected versions (1.3K).

### [CVE-2026-53724](https://cve.now/CVE-2026-53724): Parse Server: Stored XSS via trailing-dot filename bypassing file upload extension blocklist

- Severity: Low 2.1
- Published: Jun 12, 2026
- Affected: from 9.0.0, fixed in 9.9.1-alpha.4; fixed in 8.6.79.
- Fixed in 8.6.79 (released Jun 1, 2026, 11 days before disclosure) and 9.9.1-alpha.4 (released Jun 1, 2026, 11 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 46% of parse-server downloads last week were affected versions (31.1K).

### [CVE-2026-50008](https://cve.now/CVE-2026-50008): Parse Server: Server option routeAllowList is bypassable through batch sub-requests

- Severity: Medium 6.9
- Published: Jun 12, 2026
- Affected: from 9.8.0, fixed in 9.9.1-alpha.3.
- Fixed in 9.9.1-alpha.3 (released May 27, 2026, 16 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 2% of parse-server downloads last week were affected versions (1.3K).

### [CVE-2026-47138](https://cve.now/CVE-2026-47138): Parse Server: Pre-authentication denial of service via client version header regex backtracking

- Severity: High 8.7
- Published: Jun 12, 2026
- Affected: from 9.0.0, fixed in 9.9.1-alpha.1; fixed in 8.6.77.
- Fixed in 8.6.77 (released May 17, 2026, 26 days before disclosure) and 9.9.1-alpha.1 (released May 17, 2026, 26 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 46% of parse-server downloads last week were affected versions (31K).

### [CVE-2026-47248](https://cve.now/CVE-2026-47248): Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers

- Severity: Medium 6.9
- Published: Jun 12, 2026
- Affected: from 9.0.0, fixed in 9.9.1-alpha.2; fixed in 8.6.78.
- Fixed in 8.6.78 (released May 18, 2026, 25 days before disclosure) and 9.9.1-alpha.2 (released May 18, 2026, 25 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 46% of parse-server downloads last week were affected versions (31.1K).

### [CVE-2026-43930](https://cve.now/CVE-2026-43930): Parse Server: MFA SMS one-time password accepted twice under concurrent login

- Severity: Low 2.1
- Published: May 12, 2026
- Affected: from 9.0.0, fixed in 9.9.0-alpha.2; fixed in 8.6.76.
- Fixed in 8.6.76 (released Apr 26, 2026, 16 days before disclosure) and 9.9.0-alpha.2 (released Apr 26, 2026, 16 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 44% of parse-server downloads last week were affected versions (29.4K).

### [CVE-2026-39381](https://cve.now/CVE-2026-39381): Parse Server's Endpoint \`/sessions/me\` bypasses \`\_Session\` \`protectedFields\`

- Severity: Medium 5.3
- Published: Apr 7, 2026
- Affected: from 9.0.0, fixed in 9.8.0-alpha.7; from 7.0.0, fixed in 8.6.75.
- Fixed in 8.6.75 (released Apr 6, 2026, 1 day before disclosure) and 9.8.0-alpha.7 (released Apr 6, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 21% of parse-server downloads last week were affected versions (14.4K).

### [CVE-2026-39321](https://cve.now/CVE-2026-39321): Parse Server has a login timing side-channel reveals user existence

- Severity: Medium 6.3
- Published: Apr 7, 2026
- Affected: from 9.0.0, fixed in 9.8.0-alpha.6; fixed in 8.6.74.
- Fixed in 8.6.74 (released Apr 5, 2026, 2 days before disclosure) and 9.8.0-alpha.6 (released Apr 5, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 43% of parse-server downloads last week were affected versions (29.1K).

### [CVE-2026-35200](https://cve.now/CVE-2026-35200): Parse Server has a file upload Content-Type override via extension mismatch

- Severity: Low 2.1
- Published: Apr 6, 2026
- Affected: from 9.0.0, fixed in 9.7.1-alpha.4; fixed in 8.6.73.
- Fixed in 8.6.73 (released Apr 2, 2026, 4 days before disclosure) and 9.7.1-alpha.4 (released Apr 2, 2026, 4 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 43% of parse-server downloads last week were affected versions (29.1K).

### [CVE-2026-34784](https://cve.now/CVE-2026-34784): Parse Server: Streaming file download bypasses afterFind file trigger authorization

- Severity: High 8.2
- Published: Mar 31, 2026
- Affected: from 9.0.0, fixed in 9.7.1-alpha.1; fixed in 8.6.71.
- Fixed in 8.6.71 (released Mar 30, 2026, 1 day before disclosure) and 9.7.1-alpha.1 (released Mar 30, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 43% of parse-server downloads last week were affected versions (29.1K).

### [CVE-2026-34215](https://cve.now/CVE-2026-34215): Parse Server: Auth data exposed via verify password endpoint

- Severity: High 8.2
- Published: Mar 31, 2026
- Affected: from 9.0.0, fixed in 9.7.0-alpha.7; fixed in 8.6.63.
- Fixed in 8.6.63 (released Mar 26, 2026, 5 days before disclosure) and 9.7.0-alpha.7 (released Mar 26, 2026, 5 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28.1K).

### [CVE-2026-34595](https://cve.now/CVE-2026-34595): Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value

- Severity: Medium 5.3
- Published: Mar 31, 2026
- Affected: from 9.0.0, fixed in 9.7.0-alpha.16; fixed in 8.6.70.
- Fixed in 8.6.70 (released Mar 29, 2026, 2 days before disclosure) and 9.7.0-alpha.16 (released Mar 29, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28.1K).

### [CVE-2026-34574](https://cve.now/CVE-2026-34574): Parse Server: Session field immutability bypass via falsy-value guard

- Severity: Medium 5.3
- Published: Mar 31, 2026
- Affected: from 9.0.0, fixed in 9.7.0-alpha.14; fixed in 8.6.69.
- Fixed in 8.6.69 (released Mar 29, 2026, 2 days before disclosure) and 9.7.0-alpha.14 (released Mar 29, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28.1K).

### [CVE-2026-34573](https://cve.now/CVE-2026-34573): Parse Server: GraphQL complexity validator exponential fragment traversal DoS

- Severity: High 8.2
- Published: Mar 31, 2026
- Affected: from 9.0.0, fixed in 9.7.0-alpha.12; fixed in 8.6.68.
- Fixed in 8.6.68 (released Mar 29, 2026, 2 days before disclosure) and 9.7.0-alpha.12 (released Mar 29, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28.1K).

### [CVE-2026-34532](https://cve.now/CVE-2026-34532): Parse Server: Cloud function validator bypass via prototype chain traversal

- Severity: Critical 9.1
- Published: Mar 31, 2026
- Affected: from 9.0.0, fixed in 9.7.0-alpha.11; fixed in 8.6.67.
- Fixed in 8.6.67 (released Mar 28, 2026, 3 days before disclosure) and 9.7.0-alpha.11 (released Mar 28, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28.1K).

### [CVE-2026-34373](https://cve.now/CVE-2026-34373): Parse Server: GraphQL API endpoint ignores CORS origin restriction

- Severity: Medium 5.3
- Published: Mar 31, 2026
- Affected: from 9.0.0, fixed in 9.7.0-alpha.10; from 3.5.0, fixed in 8.6.66.
- Fixed in 8.6.66 (released Mar 27, 2026, 4 days before disclosure) and 9.7.0-alpha.10 (released Mar 27, 2026, 4 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 39% of parse-server downloads last week were affected versions (26.3K).

### [CVE-2026-34363](https://cve.now/CVE-2026-34363): Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers

- Severity: High 8.2
- Published: Mar 31, 2026
- Affected: from 9.0.0, fixed in 9.7.0-alpha.9; fixed in 8.6.65.
- Fixed in 8.6.65 (released Mar 27, 2026, 4 days before disclosure) and 9.7.0-alpha.9 (released Mar 27, 2026, 4 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28.1K).

### [CVE-2026-34224](https://cve.now/CVE-2026-34224): Parse Server: MFA single-use token bypass via concurrent authData login requests

- Severity: Low 2.1
- Published: Mar 31, 2026
- Affected: from 9.0.0, fixed in 9.7.0-alpha.8; fixed in 8.6.64.
- Fixed in 8.6.64 (released Mar 26, 2026, 5 days before disclosure) and 9.7.0-alpha.8 (released Mar 26, 2026, 5 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28.1K).

### [CVE-2026-33627](https://cve.now/CVE-2026-33627): Parse Server: Auth data exposed via /users/me endpoint

- Severity: High 7.1
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.55; fixed in 8.6.61.
- Fixed in 8.6.61 (released Mar 22, 2026, 2 days before disclosure) and 9.6.0-alpha.55 (released Mar 22, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33624](https://cve.now/CVE-2026-33624): Parse Server: MFA recovery code single-use bypass via concurrent requests

- Severity: Low 2.1
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.54; fixed in 8.6.60.
- Fixed in 8.6.60 (released Mar 22, 2026, 2 days before disclosure) and 9.6.0-alpha.54 (released Mar 22, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33539](https://cve.now/CVE-2026-33539): Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter

- Severity: High 8.6
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.53; fixed in 8.6.59.
- Fixed in 8.6.59 (released Mar 21, 2026, 3 days before disclosure) and 9.6.0-alpha.53 (released Mar 21, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33538](https://cve.now/CVE-2026-33538): Parse Server: Denial of service via unindexed database query for unconfigured auth providers

- Severity: High 8.7
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.52; fixed in 8.6.58.
- Fixed in 8.6.58 (released Mar 21, 2026, 3 days before disclosure) and 9.6.0-alpha.52 (released Mar 21, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33527](https://cve.now/CVE-2026-33527): Parse Server: Session update endpoint allows overwriting server-generated session fields

- Severity: Medium 5.3
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.48; fixed in 8.6.57.
- Fixed in 8.6.57 (released Mar 21, 2026, 3 days before disclosure) and 9.6.0-alpha.48 (released Mar 21, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33508](https://cve.now/CVE-2026-33508): Parse Server: LiveQuery subscription query depth bypass

- Severity: High 8.2
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.45; fixed in 8.6.56.
- Fixed in 8.6.56 (released Mar 20, 2026, 4 days before disclosure) and 9.6.0-alpha.45 (released Mar 20, 2026, 4 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33498](https://cve.now/CVE-2026-33498): Parse Server: Query condition depth bypass via pre-validation transform pipeline

- Severity: High 8.7
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.44; fixed in 8.6.55.
- Fixed in 8.6.55 (released Mar 20, 2026, 4 days before disclosure) and 9.6.0-alpha.44 (released Mar 20, 2026, 4 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33429](https://cve.now/CVE-2026-33429): Parse Server: Protected field change detection oracle via LiveQuery watch parameter

- Severity: Medium 6.3
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.43; fixed in 8.6.54.
- Fixed in 8.6.54 (released Mar 20, 2026, 4 days before disclosure) and 9.6.0-alpha.43 (released Mar 20, 2026, 4 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33421](https://cve.now/CVE-2026-33421): Parse Server: LiveQuery bypasses CLP pointer permission enforcement

- Severity: High 7.1
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.42; fixed in 8.6.53.
- Fixed in 8.6.53 (released Mar 20, 2026, 4 days before disclosure) and 9.6.0-alpha.42 (released Mar 20, 2026, 4 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33409](https://cve.now/CVE-2026-33409): Parse Server: Auth provider validation bypass on login via partial authData

- Severity: High 7.0
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.41; fixed in 8.6.52.
- Fixed in 8.6.52 (released Mar 19, 2026, 5 days before disclosure) and 9.6.0-alpha.41 (released Mar 19, 2026, 5 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33323](https://cve.now/CVE-2026-33323): Parse Server: Email verification resend page leaks user existence

- Severity: Medium 6.3
- Published: Mar 24, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.40; fixed in 8.6.51.
- Fixed in 8.6.51 (released Mar 19, 2026, 5 days before disclosure) and 9.6.0-alpha.40 (released Mar 19, 2026, 5 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (28K).

### [CVE-2026-33163](https://cve.now/CVE-2026-33163): Parse Server leaks protected fields via LiveQuery afterEvent trigger

- Severity: High 8.2
- Published: Mar 18, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.35; fixed in 8.6.50.
- Fixed in 8.6.50 (released Mar 17, 2026, 1 day before disclosure) and 9.6.0-alpha.35 (released Mar 17, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (27.9K).

### [CVE-2026-33042](https://cve.now/CVE-2026-33042): Parse Server affected by empty authData bypassing credential requirement on signup

- Severity: Medium 6.9
- Published: Mar 18, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.29; fixed in 8.6.49.
- Fixed in 8.6.49 (released Mar 16, 2026, 2 days before disclosure) and 9.6.0-alpha.29 (released Mar 16, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (27.9K).

### [CVE-2026-32944](https://cve.now/CVE-2026-32944): Parse Server crash via deeply nested query condition operators

- Severity: High 8.7
- Published: Mar 18, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.21; fixed in 8.6.45.
- Fixed in 8.6.45 (released Mar 15, 2026, 3 days before disclosure) and 9.6.0-alpha.21 (released Mar 15, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (27.9K).

### [CVE-2026-32943](https://cve.now/CVE-2026-32943): Parse Server has a password reset token single-use bypass via concurrent requests

- Severity: Low 2.3
- Published: Mar 18, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.28; fixed in 8.6.48.
- Fixed in 8.6.48 (released Mar 16, 2026, 2 days before disclosure) and 9.6.0-alpha.28 (released Mar 16, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (27.9K).

### [CVE-2026-32886](https://cve.now/CVE-2026-32886): Parse Server's Cloud function dispatch crashes server via prototype chain traversal

- Severity: High 8.2
- Published: Mar 18, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.24; fixed in 8.6.47.
- Fixed in 8.6.47 (released Mar 15, 2026, 3 days before disclosure) and 9.6.0-alpha.24 (released Mar 15, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (27.9K).

### [CVE-2026-32878](https://cve.now/CVE-2026-32878): Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

- Severity: Medium 5.3
- Published: Mar 18, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.20; fixed in 8.6.44.
- Fixed in 8.6.44 (released Mar 14, 2026, 4 days before disclosure) and 9.6.0-alpha.20 (released Mar 14, 2026, 4 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (27.9K).

### [CVE-2026-32770](https://cve.now/CVE-2026-32770): Parse Server: LiveQuery subscription with invalid regular expression crashes server

- Severity: Medium 5.9
- Published: Mar 18, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.19; fixed in 8.6.43.
- Fixed in 8.6.43 (released Mar 14, 2026, 4 days before disclosure) and 9.6.0-alpha.19 (released Mar 14, 2026, 4 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (27.9K).

### [CVE-2026-32742](https://cve.now/CVE-2026-32742): Parse Server session creation endpoint allows overwriting server-generated session fields

- Severity: Medium 4.3
- Published: Mar 18, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.17; fixed in 8.6.42.
- Fixed in 8.6.42 (released Mar 13, 2026, 5 days before disclosure) and 9.6.0-alpha.17 (released Mar 13, 2026, 5 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (27.9K).

### [CVE-2026-32728](https://cve.now/CVE-2026-32728): Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries

- Severity: High 8.3
- Published: Mar 18, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.15; fixed in 8.6.41.
- Fixed in 8.6.41 (released Mar 13, 2026, 5 days before disclosure) and 9.6.0-alpha.15 (released Mar 13, 2026, 5 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 42% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-32594](https://cve.now/CVE-2026-32594): Parse Server GraphQL WebSocket endpoint bypasses security middleware

- Severity: Medium 6.9
- Published: Mar 13, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.14; fixed in 8.6.40.
- Fixed in 8.6.40 (released Mar 12, 2026, 1 day before disclosure) and 9.6.0-alpha.14 (released Mar 12, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-32269](https://cve.now/CVE-2026-32269): Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

- Severity: Medium 6.3
- Published: Mar 12, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.13; from 8.0.2, fixed in 8.6.39.
- Fixed in 8.6.39 (released Mar 11, 2026, 1 day before disclosure) and 9.6.0-alpha.13 (released Mar 11, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 6.8% of parse-server downloads last week were affected versions (4.5K).

### [CVE-2026-32248](https://cve.now/CVE-2026-32248): Parse Server: Account takeover via operator injection in authentication data identifier

- Severity: Critical 9.3
- Published: Mar 12, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.12; fixed in 8.6.38.
- Fixed in 8.6.38 (released Mar 11, 2026, 1 day before disclosure) and 9.6.0-alpha.12 (released Mar 11, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-32242](https://cve.now/CVE-2026-32242): Parse Server OAuth2 adapter shares mutable state across providers via singleton instance

- Severity: Critical 9.1
- Published: Mar 12, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.11; fixed in 8.6.37.
- Fixed in 8.6.37 (released Mar 11, 2026, 1 day before disclosure) and 9.6.0-alpha.11 (released Mar 11, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-32234](https://cve.now/CVE-2026-32234): Parse Server has a SQL injection via query field name when using PostgreSQL

- Severity: Medium 5.1
- Published: Mar 11, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.10; fixed in 8.6.36.
- Fixed in 8.6.36 (released Mar 11, 2026, the day of disclosure) and 9.6.0-alpha.10 (released Mar 11, 2026, the day of disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-32098](https://cve.now/CVE-2026-32098): Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause

- Severity: Medium 6.9
- Published: Mar 11, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.9; fixed in 8.6.35.
- Fixed in 8.6.35 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.9 (released Mar 10, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-31901](https://cve.now/CVE-2026-31901): Parse Server has user enumeration via email verification endpoint

- Severity: Medium 6.3
- Published: Mar 11, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.8; fixed in 8.6.34.
- Fixed in 8.6.34 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.8 (released Mar 10, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-31875](https://cve.now/CVE-2026-31875): Parse Server MFA recovery codes not consumed after use

- Severity: High 8.2
- Published: Mar 11, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.7; fixed in 8.6.33.
- Fixed in 8.6.33 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.7 (released Mar 10, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-31872](https://cve.now/CVE-2026-31872): Parse Server has a protected fields bypass via dot-notation in query and sort

- Severity: High 8.7
- Published: Mar 11, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.6; fixed in 8.6.32.
- Fixed in 8.6.32 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.6 (released Mar 10, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-31871](https://cve.now/CVE-2026-31871): Parse Server has a SQL Injection via dot-notation sub-key name in \`Increment\` operation on PostgreSQL

- Severity: Critical 9.3
- Published: Mar 11, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.5; fixed in 8.6.31.
- Fixed in 8.6.31 (released Mar 10, 2026, 1 day before disclosure) and 9.6.0-alpha.5 (released Mar 10, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.8K).

### [CVE-2026-31868](https://cve.now/CVE-2026-31868): Parse Server has Stored XSS via file upload of HTML-renderable file types

- Severity: Medium 6.3
- Published: Mar 11, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.4; fixed in 8.6.30.
- Fixed in 8.6.30 (released Mar 9, 2026, 2 days before disclosure) and 9.6.0-alpha.4 (released Mar 9, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.7K).

### [CVE-2026-31856](https://cve.now/CVE-2026-31856): Parse Server has a SQL injection via \`Increment\` operation on nested object field in PostgreSQL

- Severity: Critical 9.3
- Published: Mar 11, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.6.0-alpha.3; fixed in 8.6.29.
- Fixed in 8.6.29 (released Mar 9, 2026, 2 days before disclosure) and 9.6.0-alpha.3 (released Mar 9, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.7K).

### [CVE-2026-31840](https://cve.now/CVE-2026-31840): Parse Server has a SQL injection via dot-notation field name in PostgreSQL

- Severity: Critical 9.3
- Published: Mar 11, 2026
- Affected: from 9.0.0, fixed in 9.6.0-alpha.2; fixed in 8.6.28.
- Fixed in 8.6.28 (released Mar 9, 2026, 2 days before disclosure) and 9.6.0-alpha.2 (released Mar 9, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.7K).

### [CVE-2026-31828](https://cve.now/CVE-2026-31828): Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction

- Severity: Medium 6.0
- Published: Mar 10, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.13; fixed in 8.6.26.
- Fixed in 8.6.26 (released Mar 9, 2026, 1 day before disclosure) and 9.5.2-alpha.13 (released Mar 9, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.7K).

### [CVE-2026-31800](https://cve.now/CVE-2026-31800): Parse Server: Classes \`\_GraphQLConfig\` and \`\_Audience\` master key bypass via generic class routes

- Severity: High 8.8
- Published: Mar 10, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.12; fixed in 8.6.25.
- Fixed in 8.6.25 (released Mar 9, 2026, 1 day before disclosure) and 9.5.2-alpha.12 (released Mar 9, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.6K).

### [CVE-2026-30972](https://cve.now/CVE-2026-30972): Parse Server has a rate limit bypass via batch request endpoint

- Severity: Medium 6.9
- Published: Mar 10, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.10; fixed in 8.6.23.
- Fixed in 8.6.23 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.10 (released Mar 8, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.6K).

### [CVE-2026-30967](https://cve.now/CVE-2026-30967): Parse Server OAuth2 authentication adapter account takeover via identity spoofing

- Severity: High 7.6
- Published: Mar 10, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.9; fixed in 8.6.22.
- Fixed in 8.6.22 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.9 (released Mar 8, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.6K).

### [CVE-2026-30966](https://cve.now/CVE-2026-30966): Parse Server role escalation and CLP bypass via direct \`\_Join\` table write

- Severity: Critical 10.0
- Published: Mar 10, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.7; fixed in 8.6.20.
- Fixed in 8.6.20 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.7 (released Mar 8, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.6K).

### [CVE-2026-30965](https://cve.now/CVE-2026-30965): Parse Server session token exfiltration via \`redirectClassNameForKey\` query parameter

- Severity: Critical 9.9
- Published: Mar 10, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.5.2-alpha.8; fixed in 8.6.21.
- Fixed in 8.6.21 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.8 (released Mar 8, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.6K).

### [CVE-2026-30962](https://cve.now/CVE-2026-30962): Parse Server has a protected fields bypass via logical query operators

- Severity: High 7.1
- Published: Mar 10, 2026
- Affected: from 9.0.0, fixed in 9.5.2-alpha.6; fixed in 8.6.19.
- Fixed in 8.6.19 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.6 (released Mar 8, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.6K).

### [CVE-2026-30949](https://cve.now/CVE-2026-30949): Parse Server is missing audience validation in Keycloak authentication adapter

- Severity: High 7.6
- Published: Mar 10, 2026
- Affected: from 9.0.0, fixed in 9.5.2-alpha.5; fixed in 8.6.18.
- Fixed in 8.6.18 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.5 (released Mar 8, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.5K).

### [CVE-2026-30948](https://cve.now/CVE-2026-30948): Parse Server has stored cross-site scripting (XSS) via SVG file upload

- Severity: High 8.3
- Published: Mar 10, 2026
- Affected: from 9.0.0, fixed in 9.5.2-alpha.4; fixed in 8.6.17.
- Fixed in 8.6.17 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.4 (released Mar 8, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.5K).

### [CVE-2026-30947](https://cve.now/CVE-2026-30947): Parse Server ha a bypass of class-level permissions in LiveQuery

- Severity: High 8.7
- Published: Mar 10, 2026
- Affected: from 9.0.0, fixed in 9.5.2-alpha.3; fixed in 8.6.16.
- Fixed in 8.6.16 (released Mar 8, 2026, 2 days before disclosure) and 9.5.2-alpha.3 (released Mar 8, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.5K).

### [CVE-2026-30946](https://cve.now/CVE-2026-30946): Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API

- Severity: High 8.7
- Published: Mar 10, 2026
- Affected: fixed in 8.6.15; from 9.0.0, fixed in 9.5.2-alpha.2.
- Fixed in 8.6.15 (released Mar 7, 2026, 3 days before disclosure) and 9.5.2-alpha.2 (released Mar 7, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.5K).

### [CVE-2026-30941](https://cve.now/CVE-2026-30941): Parse Server has a NoSQL injection via token type in password reset and email verification endpoints

- Severity: High 8.7
- Published: Mar 10, 2026
- Affected: from 9.0.0, fixed in 9.5.2-alpha.1; fixed in 8.6.14.
- Fixed in 8.6.14 (released Mar 7, 2026, 3 days before disclosure) and 9.5.2-alpha.1 (released Mar 7, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.5K).

### [CVE-2026-30939](https://cve.now/CVE-2026-30939): Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

- Severity: High 8.8
- Published: Mar 10, 2026
- Affected: fixed in 8.6.13; from 9.0.0-alpha.1, fixed in 9.5.1-alpha.2.
- Fixed in 8.6.13 (released Mar 7, 2026, 3 days before disclosure) and 9.5.1-alpha.2 (released Mar 7, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.4K).

### [CVE-2026-30938](https://cve.now/CVE-2026-30938): Parse Server has denylist \`requestKeywordDenylist\` keyword scan bypass through nested object placement

- Severity: Medium 6.9
- Published: Mar 10, 2026
- Affected: fixed in 8.6.12; from 9.0.0-alpha.1, fixed in 9.5.1-alpha.1.
- Fixed in 8.6.12 (released Mar 7, 2026, 3 days before disclosure) and 9.5.1-alpha.1 (released Mar 7, 2026, 3 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.4K).

### [CVE-2026-30925](https://cve.now/CVE-2026-30925): Parse Server affected by Regular Expression Denial of Service (ReDoS) via \`$regex\` query in LiveQuery

- Severity: High 8.2
- Published: Mar 9, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.5.0-alpha.14; fixed in 8.6.11.
- Fixed in 8.6.11 (released Mar 7, 2026, 2 days before disclosure) and 9.5.0-alpha.14 (released Mar 7, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.4K).

### [CVE-2026-30854](https://cve.now/CVE-2026-30854): Parse Server: GraphQL \`\_\_type\` introspection bypass via inline fragments when public introspection is disabled

- Severity: Medium 6.9
- Published: Mar 7, 2026
- Affected: from 9.3.1-alpha.3, fixed in 9.5.0-alpha.10.
- Fixed in 9.5.0-alpha.10 (released Mar 6, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 0.8% of parse-server downloads last week were affected versions (517).

### [CVE-2026-30850](https://cve.now/CVE-2026-30850): Parse Server: File metadata endpoint bypasses \`beforeFind\` / \`afterFind\` trigger authorization

- Severity: Medium 6.3
- Published: Mar 7, 2026
- Affected: fixed in 8.6.9; from 9.0.0-alpha.1, fixed in 9.5.0-alpha.9.
- Fixed in 8.6.9 (released Mar 6, 2026, 1 day before disclosure) and 9.5.0-alpha.9 (released Mar 6, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.3K).

### [CVE-2026-30848](https://cve.now/CVE-2026-30848): Parse Server: \`PagesRouter\` path traversal allows reading files outside configured pages directory

- Severity: Medium 6.3
- Published: Mar 7, 2026
- Affected: fixed in 8.6.8; from 9.0.0-alpha.1, fixed in 9.5.0-alpha.8.
- Fixed in 8.6.8 (released Mar 5, 2026, 2 days before disclosure) and 9.5.0-alpha.8 (released Mar 5, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.3K).

### [CVE-2026-30863](https://cve.now/CVE-2026-30863): Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters

- Severity: Critical 9.3
- Published: Mar 7, 2026
- Affected: from 9.0.0-alpha.1, fixed in 9.5.0-alpha.11; fixed in 8.6.10.
- Fixed in 8.6.10 (released Mar 6, 2026, 1 day before disclosure) and 9.5.0-alpha.11 (released Mar 6, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.3K).

### [CVE-2026-30835](https://cve.now/CVE-2026-30835): Parse Server: Malformed \`$regex\` query leaks database error details in API response

- Severity: Medium 6.9
- Published: Mar 6, 2026
- Affected: from 9.0.0, fixed in 9.5.0-alpha.6; fixed in 8.6.7.
- Fixed in 8.6.7 (released Mar 5, 2026, 1 day before disclosure) and 9.5.0-alpha.6 (released Mar 5, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.2K).

### [CVE-2026-30229](https://cve.now/CVE-2026-30229): Parse Server: Endpoint \`/loginAs\` allows \`readOnlyMasterKey\` to gain full read and write access as any user

- Severity: High 8.5
- Published: Mar 6, 2026
- Affected: fixed in 8.6.6; from 9.0.0, fixed in 9.5.0-alpha.4.
- Fixed in 8.6.6 (released Mar 5, 2026, 1 day before disclosure) and 9.5.0-alpha.4 (released Mar 5, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.2K).

### [CVE-2026-30228](https://cve.now/CVE-2026-30228): Parse Server: File creation and deletion bypasses \`readOnlyMasterKey\` write restriction

- Severity: Medium 6.9
- Published: Mar 6, 2026
- Affected: from 9.0.0, fixed in 9.5.0-alpha.3; fixed in 8.6.5.
- Fixed in 8.6.5 (released Mar 5, 2026, 1 day before disclosure) and 9.5.0-alpha.3 (released Mar 5, 2026, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 41% of parse-server downloads last week were affected versions (27.2K).

### [CVE-2026-29182](https://cve.now/CVE-2026-29182): Parse Server: Cloud Hooks and Cloud Jobs bypass \`readOnlyMasterKey\` write restriction

- Severity: High 8.6
- Published: Mar 6, 2026
- Affected: from 9.0.0, fixed in 9.4.1-alpha.3; fixed in 8.6.4.
- Fixed in 8.6.4 (released Mar 4, 2026, 2 days before disclosure) and 9.4.1-alpha.3 (released Mar 4, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 40% of parse-server downloads last week were affected versions (27.1K).

### [CVE-2026-27804](https://cve.now/CVE-2026-27804): Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter

- Severity: Critical 9.3
- Published: Feb 25, 2026
- Affected: from 9.0.0, fixed in 9.3.1-alpha.4; fixed in 8.6.3.
- Fixed in 8.6.3 (released Feb 23, 2026, 2 days before disclosure) and 9.3.1-alpha.4 (released Feb 23, 2026, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 40% of parse-server downloads last week were affected versions (26.7K).

### [CVE-2025-68150](https://cve.now/CVE-2025-68150): Parse Server has Server-Side Request Forgery (SSRF) in Instagram OAuth Adapter

- Severity: High 8.3
- Published: Dec 16, 2025
- Affected: from 9.0.0, fixed in 9.1.1-alpha.1; fixed in 8.6.2.
- Fixed in 8.6.2 (released Dec 16, 2025, the day of disclosure) and 9.1.1-alpha.1 (released Dec 16, 2025, the day of disclosure).
- The latest release, 9.11.0, is not affected.
- 39% of parse-server downloads last week were affected versions (26.4K).

### [CVE-2025-68115](https://cve.now/CVE-2025-68115): Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables

- Severity: Medium 5.3
- Published: Dec 16, 2025
- Affected: fixed in 8.6.1; from 9.0.0, fixed in 9.1.0-alpha.3.
- Fixed in 8.6.1 (released Dec 14, 2025, 2 days before disclosure) and 9.1.0-alpha.3 (released Dec 14, 2025, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 39% of parse-server downloads last week were affected versions (26.4K).

### [CVE-2025-64502](https://cve.now/CVE-2025-64502): Parse Server allows public \`explain\` queries which may expose sensitive database performance information and schema details

- Severity: Medium 6.9
- Published: Nov 10, 2025
- Affected: fixed in 8.5.0-alpha.5.
- Fixed in 8.5.0-alpha.5 (released Nov 8, 2025, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 39% of parse-server downloads last week were affected versions (26.1K).

### [CVE-2025-64430](https://cve.now/CVE-2025-64430): Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format

- Severity: High 7.5
- Published: Nov 7, 2025
- Affected: from 4.2.0, fixed in 7.5.4; from 8.0.0, fixed in 8.4.0-alpha.2.
- Fixed in 7.5.4 (released Nov 5, 2025, 2 days before disclosure) and 8.4.0-alpha.2 (released Nov 5, 2025, 2 days before disclosure).
- The latest release, 9.11.0, is not affected.
- 29% of parse-server downloads last week were affected versions (19.3K).

### [CVE-2025-53364](https://cve.now/CVE-2025-53364): Parse Server exposes the data schema via GraphQL API

- Severity: Medium 5.3
- Published: Jul 10, 2025
- Affected: from 8.0.0, fixed in 8.2.2; from 5.3.0, fixed in 7.5.3.
- Fixed in 7.5.3 (released Jul 10, 2025, the day of disclosure) and 8.2.2 (released Jul 10, 2025, the day of disclosure).
- The latest release, 9.11.0, is not affected.
- 20% of parse-server downloads last week were affected versions (13.2K).

### [CVE-2025-30168](https://cve.now/CVE-2025-30168): Parse Server has an OAuth login vulnerability

- Severity: Medium 6.9
- Published: Mar 21, 2025
- Affected: fixed in 7.5.2; from 8.0.0, fixed in 8.0.2.
- Fixed in 7.5.2 (released Mar 21, 2025, the day of disclosure) and 8.0.2 (released Mar 21, 2025, the day of disclosure).
- The latest release, 9.11.0, is not affected.
- 28% of parse-server downloads last week were affected versions (18.7K).

### [CVE-2024-47183](https://cve.now/CVE-2024-47183): Parse Server's custom object ID allows to acquire role privileges

- Severity: High 8.1
- Published: Oct 4, 2024
- Affected: fixed in 6.5.9; from 7.0.0, fixed in 7.3.0.
- Fixed in 6.5.9 and 7.3.0 (released Oct 3, 2024, 1 day before disclosure).
- The latest release, 9.11.0, is not affected.
- 22% of parse-server downloads last week were affected versions (14.9K).

### [CVE-2024-39309](https://cve.now/CVE-2024-39309): ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability

- Severity: Critical 9.8
- Published: Jul 1, 2024
- Affected: fixed in 6.5.7; from 7.0.0, fixed in 7.1.0.
- Fixed in 6.5.7 and 7.3.0 (released Oct 3, 2024, 94 days after disclosure, the advisory names 7.1.0, which was never published).
- The latest release, 9.11.0, is not affected.
- 16% of parse-server downloads last week were affected versions (10.4K).

### [CVE-2024-29027](https://cve.now/CVE-2024-29027): Parse Server crash and RCE via invalid Cloud Function or Cloud Job name

- Severity: Critical 9.1
- Published: Mar 19, 2024
- Affected: fixed in 6.5.5; from 7.0.0-alpha.1, fixed in 7.0.0-alpha.29.
- Fixed in 6.5.5 and 7.3.0 (released Oct 3, 2024, 198 days after disclosure, the advisory names 7.0.0-alpha.29, which was never published).
- The latest release, 9.11.0, is not affected.
- 15% of parse-server downloads last week were affected versions (10K).

### [CVE-2024-27298](https://cve.now/CVE-2024-27298): Parse Server literalizeRegexPart SQL Injection

- Severity: Critical 10.0
- Published: Mar 1, 2024
- Affected: fixed in 6.5.0; from 7.0.0-alpha.1, fixed in 7.0.0-alpha.20.
- Fixed in 6.5.0 and 7.3.0 (released Oct 3, 2024, 216 days after disclosure, the advisory names 7.0.0-alpha.20, which was never published).
- The latest release, 9.11.0, is not affected.
- 15% of parse-server downloads last week were affected versions (9.9K).

### [CVE-2023-46119](https://cve.now/CVE-2023-46119): Parse Server may crash when uploading file without extension

- Severity: High 7.5
- Published: Oct 25, 2023
- Affected: from 1.0.0, fixed in 5.5.6; from 6.0.0, fixed in 6.3.1.
- Fixed in 5.5.6 and 6.3.1.
- The latest release, 9.11.0, is not affected.
- 12% of parse-server downloads last week were affected versions (8K).

### [CVE-2023-41058](https://cve.now/CVE-2023-41058): Trigger \`beforeFind\` not invoked in internal query pipeline in parse-server

- Severity: High 7.5
- Published: Sep 4, 2023
- Affected: from 1.0.0, fixed in 5.5.5; from 6.0.0, fixed in 6.2.2.
- Fixed in 5.5.5 and 6.2.2.
- The latest release, 9.11.0, is not affected.
- 12% of parse-server downloads last week were affected versions (7.8K).

### [CVE-2023-36475](https://cve.now/CVE-2023-36475): Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution

- Severity: Critical 9.8
- Published: Jun 28, 2023
- Affected: fixed in 5.5.2; from 6.0.0, fixed in 6.2.1.
- Fixed in 5.5.2 and 6.2.1.
- The latest release, 9.11.0, is not affected.
- 11% of parse-server downloads last week were affected versions (7.6K).

### [CVE-2023-32689](https://cve.now/CVE-2023-32689): Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file

- Severity: Medium 6.3
- Published: May 30, 2023
- Affected: fixed in 5.4.4; from 6.0.0, fixed in 6.1.1.
- Fixed in 5.4.4 and 6.1.1.
- The latest release, 9.11.0, is not affected.
- 11% of parse-server downloads last week were affected versions (7.6K).

### [CVE-2023-22474](https://cve.now/CVE-2023-22474): Parse Server is vulnerable to authentication bypass via spoofing

- Severity: High 8.7
- Published: Feb 3, 2023
- Affected: fixed in 5.4.1.
- Fixed in 5.4.1.
- The latest release, 9.11.0, is not affected.
- 11% of parse-server downloads last week were affected versions (7.2K).

### [CVE-2022-41879](https://cve.now/CVE-2022-41879): Parse Server subject to Prototype pollution via Cloud Code Webhooks

- Severity: High 7.2
- Published: Nov 10, 2022
- Affected: fixed in 4.10.20; from 5.0.0, fixed in 5.3.3.
- Fixed in 4.10.20 and 5.3.3.
- The latest release, 9.11.0, is not affected.
- 10% of parse-server downloads last week were affected versions (6.7K).

### [CVE-2022-41878](https://cve.now/CVE-2022-41878): Parse Server Prototype pollution and Injection via Cloud Code Webhooks or Cloud Code Triggers

- Severity: High 7.2
- Published: Nov 10, 2022
- Affected: fixed in 4.10.19; from 5.0.0, fixed in 5.3.2.
- Fixed in 4.10.19 and 5.3.2.
- The latest release, 9.11.0, is not affected.
- 10% of parse-server downloads last week were affected versions (6.7K).

### [CVE-2022-39396](https://cve.now/CVE-2022-39396): Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser

- Severity: Critical 9.8
- Published: Nov 10, 2022
- Affected: fixed in 4.10.18; from 5.0.0, fixed in 5.3.1.
- Fixed in 4.10.18 and 5.3.1.
- The latest release, 9.11.0, is not affected.
- 10% of parse-server downloads last week were affected versions (6.7K).

### [CVE-2022-39313](https://cve.now/CVE-2022-39313): Parse Server crashes when receiving file download request with invalid byte range

- Severity: High 7.5
- Published: Oct 24, 2022
- Affected: fixed in 4.10.17; from 5.0.0, fixed in 5.2.8.
- Fixed in 4.10.17 and 5.2.8.
- The latest release, 9.11.0, is not affected.
- 7.3% of parse-server downloads last week were affected versions (4.9K).

### [CVE-2022-39231](https://cve.now/CVE-2022-39231): Parse Server subject to Improper Authentication allowing Auth adapter app ID validation to be circumvented

- Severity: Low 3.7
- Published: Sep 23, 2022
- Affected: fixed in 4.10.16; from 5.0.0, fixed in 5.2.7.
- Fixed in 4.10.16 and 5.2.7.
- The latest release, 9.11.0, is not affected.
- 7.3% of parse-server downloads last week were affected versions (4.9K).

### [CVE-2022-39225](https://cve.now/CVE-2022-39225): Parse Server subject to Incorrect Resource Transfer Between Spheres

- Severity: Medium 4.3
- Published: Sep 23, 2022
- Affected: fixed in 4.10.15; from 5.0.0, fixed in 5.2.6.
- Fixed in 4.10.15 and 5.2.6.
- The latest release, 9.11.0, is not affected.
- 7.3% of parse-server downloads last week were affected versions (4.9K).

### [CVE-2022-36079](https://cve.now/CVE-2022-36079): Parse Server vulnerable to brute force guessing of user sensitive data via search patterns

- Severity: High 8.6
- Published: Sep 7, 2022
- Affected: fixed in 4.10.14; from 5.0.0, fixed in 5.2.5.
- Fixed in 4.10.14 and 5.2.5.
- The latest release, 9.11.0, is not affected.
- 7.3% of parse-server downloads last week were affected versions (4.9K).

### [CVE-2022-31112](https://cve.now/CVE-2022-31112): Protected fields exposed via LiveQuery in parse-server

- Severity: High 8.2
- Published: Jun 30, 2022
- Affected: fixed in 4.10.13; from 5.0.0, fixed in 5.2.4.
- Fixed in 4.10.13 and 5.2.4.
- The latest release, 9.11.0, is not affected.
- 7.2% of parse-server downloads last week were affected versions (4.8K).

### [CVE-2022-31089](https://cve.now/CVE-2022-31089): Invalid file request can crashe parse-server

- Severity: High 7.5
- Published: Jun 27, 2022
- Affected: fixed in 4.10.12; from 5.0.0, fixed in 5.2.3.
- Fixed in 4.10.12 and 5.2.3.
- The latest release, 9.11.0, is not affected.
- 7.2% of parse-server downloads last week were affected versions (4.8K).

### [CVE-2022-31083](https://cve.now/CVE-2022-31083): Authentication bypass in Parse Server Apple Game Center auth adapter

- Severity: High 8.6
- Published: Jun 17, 2022
- Affected: fixed in 4.10.11; from 5.0.0, fixed in 5.2.2.
- Fixed in 4.10.11 and 5.2.2.
- The latest release, 9.11.0, is not affected.
- 7.2% of parse-server downloads last week were affected versions (4.8K).

### [CVE-2022-24901](https://cve.now/CVE-2022-24901): Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter

- Severity: High 7.5
- Published: May 4, 2022
- Affected: fixed in 4.10.10; from 5.0.0, fixed in 5.2.1.
- Fixed in 4.10.10 and 5.2.1.
- The latest release, 9.11.0, is not affected.
- 7.1% of parse-server downloads last week were affected versions (4.8K).

### [CVE-2022-24760](https://cve.now/CVE-2022-24760): Command Injection in Parse server

- Severity: Critical 10.0
- Published: Mar 11, 2022
- Affected: fixed in 4.10.7.
- Fixed in 4.10.7.
- The latest release, 9.11.0, is not affected.
- 6.8% of parse-server downloads last week were affected versions (4.5K).

### [CVE-2021-41109](https://cve.now/CVE-2021-41109): LiveQuery publishes user session tokens

- Severity: High 7.5
- Published: Sep 30, 2021
- Affected: fixed in 4.10.4.
- Fixed in 4.10.4.
- The latest release, 9.11.0, is not affected.
- 6.7% of parse-server downloads last week were affected versions (4.5K).

### [CVE-2021-39187](https://cve.now/CVE-2021-39187): Crash server with query parameter

- Severity: High 7.5
- Published: Sep 2, 2021
- Affected: fixed in 4.10.3.
- Fixed in 4.10.3.
- The latest release, 9.11.0, is not affected.
- 6.7% of parse-server downloads last week were affected versions (4.5K).

### [CVE-2021-39138](https://cve.now/CVE-2021-39138): New anonymous user session acts as if it's created with password

- Severity: Medium 4.8
- Published: Aug 18, 2021
- Affected: fixed in 4.5.2.
- Fixed in 4.5.2.
- The latest release, 9.11.0, is not affected.
- 6.7% of parse-server downloads last week were affected versions (4.5K).

### [CVE-2020-26288](https://cve.now/CVE-2020-26288): Parse Server stores password in plain text

- Severity: High 7.7
- Published: Dec 30, 2020
- Affected: fixed in 4.5.0.
- Fixed in 4.5.0.
- The latest release, 9.11.0, is not affected.
- 6.2% of parse-server downloads last week were affected versions (4.2K).

### [CVE-2020-15270](https://cve.now/CVE-2020-15270): Improper session expiration in Parse Server

- Severity: Medium 4.3
- Published: Oct 22, 2020
- Affected: fixed in 4.4.0.
- Fixed in 4.4.0.
- The latest release, 9.11.0, is not affected.
- 6.1% of parse-server downloads last week were affected versions (4.1K).

### [CVE-2020-15126](https://cve.now/CVE-2020-15126): Information disclosure through Viewer query in parse-server

- Severity: Medium 6.5
- Published: Jul 22, 2020
- Affected: from 3.5.0, fixed in 4.3.0.
- Fixed in 4.3.0.
- The latest release, 9.11.0, is not affected.
- 3.4% of parse-server downloads last week were affected versions (2.3K).

### [CVE-2020-5251](https://cve.now/CVE-2020-5251): Information disclosure in parse-server

- Severity: High 7.7
- Published: Mar 4, 2020
- Affected: fixed in 4.1.0.
- Fixed in 4.1.0.
- The latest release, 9.11.0, is not affected.
- 5.8% of parse-server downloads last week were affected versions (3.9K).

### [CVE-2019-1020013](https://cve.now/CVE-2019-1020013): parse-server before 3.6.0 allows account enumeration.

- Severity: Unrated
- Published: Jul 29, 2019
- Affected: fixed in 3.6.0.
- Fixed in 3.6.0.
- The latest release, 9.11.0, is not affected.
- 2.6% of parse-server downloads last week were affected versions (1.8K).

### [CVE-2019-1020012](https://cve.now/CVE-2019-1020012): parse-server before 3.4.1 allows DoS after any POST to a volatile class.

- Severity: Unrated
- Published: Jul 29, 2019
- Affected: fixed in 3.4.1.
- Fixed in 3.4.1.
- The latest release, 9.11.0, is not affected.
- 2.6% of parse-server downloads last week were affected versions (1.7K).

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/parse-server
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.