Skip to content
OpenAdvisories

Package · npm

parse-server

117 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

40 results · Clear filters · Feed

  • Medium 6.9
    CVE-2026-53726

    Parse Server: Relation `$relatedTo` query bypasses `protectedFields` and owning-object ACL

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.80 and 9.9.1-alpha.6, a relation query using the $relatedTo operator could read the membership of a Relation field even when that fie…

    parse-community parse-server parse-server npm
  • Medium 5.9
    CVE-2026-53725

    Parse Server: Endpoints `/login` and `/verifyPassword` disclose MFA secrets and protected fields when `_User` get is denied

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.5, apps that enable MFA and deny get on the _User class via Class-Level Permissions could expose sensitive…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-50008

    Parse Server: Server option routeAllowList is bypassable through batch sub-requests

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.8.0 to before version 9.9.1-alpha.3, the routeAllowList server option restricts external client access to a configured list of REST API rout…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-47248

    Parse Server: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.78 and 9.9.1-alpha.2, Parse Server's GraphQL endpoint discloses schema metadata to unauthenticated callers through Did you mean ...? …

    parse-community parse-server parse-server npm
  • Medium 5.3
    CVE-2026-39381

    Parse Server's Endpoint `/sessions/me` bypasses `_Session` `protectedFields`

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.7 and 8.6.75, the GET /sessions/me endpoint returns _Session fields that the server operator explicitly configured as protected via th…

    parse-community parse-server parse-server npm
  • Medium 6.3
    CVE-2026-39321

    Parse Server has a login timing side-channel reveals user existence

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.8.0-alpha.6 and 8.6.74, he login endpoint response time differs measurably depending on whether the submitted username or email exists in the da…

    parse-community parse-server parse-server npm
  • Medium 5.3
    CVE-2026-34595

    Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.70 and 9.7.0-alpha.18, an authenticated user with find class-level permission can bypass the protectedFields class-level permission s…

    parse-community parse-server parse-server npm
  • Medium 5.3
    CVE-2026-34574

    Parse Server: Session field immutability bypass via falsy-value guard

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.69 and 9.7.0-alpha.14, an authenticated user can bypass the immutability guard on session fields (expiresAt, createdWith) by sending …

    parse-community parse-server parse-server npm
  • Medium 5.3
    CVE-2026-34373

    Parse Server: GraphQL API endpoint ignores CORS origin restriction

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origi…

    parse-community parse-server parse-server npm
  • Medium 5.3
    CVE-2026-33527

    Parse Server: Session update endpoint allows overwriting server-generated session fields

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when upd…

    parse-community parse-server parse-server npm
  • Medium 6.3
    CVE-2026-33429

    Parse Server: Protected field change detection oracle via LiveQuery watch parameter

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protec…

    parse-community parse-server parse-server npm
  • Medium 6.3
    CVE-2026-33323

    Parse Server: Email verification resend page leaks user existence

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable respo…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-33042

    Parse Server affected by empty authData bypassing credential requirement on signup

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and pass…

    parse-community parse-server parse-server npm
  • Medium 5.3
    CVE-2026-32878

    Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields…

    parse-community parse-server parse-server npm
  • Medium 5.9
    CVE-2026-32770

    Parse Server: LiveQuery subscription with invalid regular expression crashes server

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.19 and 8.6.43, a remote attacker can crash the Parse Server by subscribing to a LiveQuery with an invalid regular expression pattern. …

    parse-community parse-server parse-server npm
  • Medium 4.3
    CVE-2026-32742

    Parse Server session creation endpoint allows overwriting server-generated session fields

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.17 and 8.6.42, an authenticated user can overwrite server-generated session fields (`sessionToken`, `expiresAt`, `createdWith`) when c…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-32594

    Parse Server GraphQL WebSocket endpoint bypasses security middleware

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.40 and 9.6.0-alpha.14, the GraphQL WebSocket endpoint for subscriptions does not pass requests through the Express middleware chain that enfor…

    parse-community parse-server parse-server npm
  • Medium 6.3
    CVE-2026-32269

    Parse Server OAuth2 adapter app ID validation sends wrong token to introspection endpoint

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.13 and 8.6.39, the OAuth2 authentication adapter does not correctly validate app IDs when appidField and appIds are configured. During…

    parse-community parse-server parse-server npm
  • Medium 5.1
    CVE-2026-32234

    Parse Server has a SQL injection via query field name when using PostgreSQL

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.10 and 8.6.36, an attacker with access to the master key can inject malicious SQL via crafted field names used in query constraints wh…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-32098

    Parse Server has a protected fields bypass via LiveQuery subscription WHERE clause

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.9 and 8.6.35, an attacker can exploit LiveQuery subscriptions to infer the values of protected fields without directly receiving them.…

    parse-community parse-server parse-server npm
  • Medium 6.3
    CVE-2026-31901

    Parse Server has user enumeration via email verification endpoint

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.34 and 9.6.0-alpha.8, the email verification endpoint (/verificationEmailRequest) returns distinct error responses depending on whether an ema…

    parse-community parse-server parse-server npm
  • Medium 6.3
    CVE-2026-31868

    Parse Server has Stored XSS via file upload of HTML-renderable file types

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.4 and 8.6.30, an attacker can upload a file with a file extension or content type that is not blocked by the default configuration of …

    parse-community parse-server parse-server npm
  • Medium 6.0
    CVE-2026-31828

    Parse Server has an LDAP injection via unsanitized user input in DN and group filter construction

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.5.2-alpha.13 and 8.6.26, the LDAP authentication adapter is vulnerable to LDAP injection. User-supplied input (authData.id) is interpolated dire…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-30972

    Parse Server has a rate limit bypass via batch request endpoint

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior o 9.5.2-alpha.10 and 8.6.23, Parse Server's rate limiting middleware is applied at the Express middleware layer, but the batch request endpoint (/bat…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-30938

    Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.12 and 9.5.1-alpha.1, the requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited ke…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-30854

    Parse Server: GraphQL `__type` introspection bypass via inline fragments when public introspection is disabled

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. From version 9.3.1-alpha.3 to before version 9.5.0-alpha.10, when graphQLPublicIntrospection is disabled, __type queries nested inside inline fragments (e.…

    parse-community parse-server parse-server npm
  • Medium 6.3
    CVE-2026-30850

    Parse Server: File metadata endpoint bypasses `beforeFind` / `afterFind` trigger authorization

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.9 and 9.5.0-alpha.9, the file metadata endpoint (GET /files/:appId/metadata/:filename) does not enforce beforeFind / afterFind file t…

    parse-community parse-server parse-server npm
  • Medium 6.3
    CVE-2026-30848

    Parse Server: `PagesRouter` path traversal allows reading files outside configured pages directory

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.8 and 9.5.0-alpha.8, the PagesRouter static file serving route is vulnerable to a path traversal attack that allows unauthenticated r…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-30835

    Parse Server: Malformed `$regex` query leaks database error details in API response

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.7 and 9.5.0-alpha.6, malformed $regex query parameter (e.g. [abc) causes the database to return a structured error object that is pas…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2026-30228

    Parse Server: File creation and deletion bypasses `readOnlyMasterKey` write restriction

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.5 and 9.5.0-alpha.3, the readOnlyMasterKey can be used to create and delete files via the Files API (POST /files/:filename, DELETE /f…

    parse-community parse-server parse-server npm
  • Medium 5.3
    CVE-2025-68115

    Parse Server vulnerable to Cross-Site Scripting (XSS) via Unescaped Mustache Template Variables

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password reset and email verifi…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2025-64502

    Parse Server allows public `explain` queries which may expose sensitive database performance information and schema details

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. The MongoDB `explain()` method provides detailed information about query execution plans, including index usage, collection scanning behavior, and performa…

    parse-community parse-server parse-server npm
  • Medium 5.3
    CVE-2025-53364

    Parse Server exposes the data schema via GraphQL API

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Starting in 5.3.0 and before 7.5.3 and 8.2.2, the Parse Server GraphQL API previously allowed public access to the GraphQL schema without requiring a sessi…

    parse-community parse-server parse-server npm
  • Medium 6.9
    CVE-2025-30168

    Parse Server has an OAuth login vulnerability

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 7.5.2 and 8.0.2, the 3rd party authentication handling of Parse Server allows the authentication credentials of some specific authentication provi…

    parse-community parse-server parse-server npm
  • Medium 6.3
    CVE-2023-32689

    Parse Server vulnerable to phishing attack vulnerability that involves uploading malicious HTML file

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 5.4.4 and 6.1.1 are vulnerable to a phishing attack vulnerability that involves a user uploading malicious files. A malicious user could …

    parse-community parse-server parse-server npm
  • Medium 4.3
    CVE-2022-39225

    Parse Server subject to Incorrect Resource Transfer Between Spheres

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior to 5.2.6, a user can write to the session object of another user if the session object ID is known. …

    parse-community parse-server parse-server npm
  • Medium 4.8
    CVE-2021-39138

    New anonymous user session acts as if it's created with password

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Developers can use the REST API to signup users and also allow users to login anonymously. Prior to version 4.5.1, when an anonymous user is first signed u…

    parse-community parse-server parse-server npm
  • Medium 4.3
    CVE-2020-15270

    Improper session expiration in Parse Server

    Parse Server (npm package parse-server) broadcasts events to all clients without checking if the session token is valid. This allows clients with expired sessions to still receive subscription objects. It is not possible to create subscription objects with in…

    parse-community parse-server parse-server npm
  • Medium 6.5
    CVE-2020-15126

    Information disclosure through Viewer query in parse-server

    In parser-server from version 3.5.0 and before 4.3.0, an authenticated user using the viewer GraphQL query can by pass all read security on his User object and can also by pass all objects linked via relation or Pointer on his User object.

    parse-community parse-server parse-server npm
  • Medium 5.3
    CVE-2019-1020013

    Sensitive Data Exposure in parse-server

    parse-server before 3.6.0 allows account enumeration.

    Parse parse-server parse-server npm