p PatchFirst

PatchFirst · Aktuelle Sicherheitslücken

Sicherheitslücken in parse-server · Seite 2

In den letzten 30 Tagen veröffentlichte Sicherheitslücken für parse-server: 0. Davon im KEV-Katalog: 0.

RSS ↗
Sicherheitslücken filtern
Filter zurücksetzen

Sicherheitslücken: 116

  1. CVE-2026-34373

    Mittel · CVSS 5.3EPSS 0,24%Korrektur verfügbar

    Parse Server: GraphQL API endpoint ignores CORS origin restriction

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction. This issue has been patched in versions 8.6.66 and 9.7.0-alpha.10.

    parse-server parse-serverNode.js
    • Auf 8.6.66 aktualisieren
    • Auf 9.7.0-alpha.10 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  2. CVE-2026-34363

    Hoch · CVSS 8.2EPSS 0,4%Korrektur verfügbar

    Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.65 and 9.7.0-alpha.9, when multiple clients subscribe to the same class via LiveQuery, the event handlers process each subscriber concurrently using shared mutable objects. The sensitive data filter modifies these shared objects in-place, so when one subscriber's filter removes a protected field, subsequent subscribers may receive the already-filtered object. This can cause protected fields and authentication data to leak to clients that should not see them, or cause clients that should see the data to receive an incom

    parse-server parse-serverNode.js
    • Auf 8.6.65 aktualisieren
    • Auf 9.7.0-alpha.9 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  3. CVE-2026-34224

    Niedrig · CVSS 2.1EPSS 0,34%Korrektur verfügbar

    Parse Server: MFA single-use token bypass via concurrent authData login requests

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.64 and 9.7.0-alpha.8, an attacker who possesses a valid authentication provider token and a single MFA recovery code or SMS one-time password can create multiple authenticated sessions by sending concurrent login requests via the authData login endpoint. This defeats the single-use guarantee of MFA recovery codes and SMS one-time passwords, allowing session persistence even after the legitimate user revokes detected sessions. This issue has been patched in versions 8.6.64 and 9.7.0-alpha.8.

    parse-server parse-serverNode.js
    • Auf 8.6.64 aktualisieren
    • Auf 9.7.0-alpha.8 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  4. CVE-2026-33627

    Hoch · CVSS 7.1EPSS 0,55%Korrektur verfügbar

    Parse Server: Auth data exposed via /users/me endpoint

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.61 and 9.6.0-alpha.55, an authenticated user calling GET /users/me receives unsanitized auth data, including sensitive credentials such as MFA TOTP secrets and recovery codes. The endpoint internally uses master-level authentication for the session query, and the master context leaks through to the user data, bypassing auth adapter sanitization. An attacker who obtains a user's session token can extract MFA secrets to generate valid TOTP codes indefinitely. This issue has been patched in versions 8.6.61 and 9.6.0-alpha

    parse-server parse-serverNode.js
    • Auf 8.6.61 aktualisieren
    • Auf 9.6.0-alpha.55 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  5. CVE-2026-33624

    Niedrig · CVSS 2.1EPSS 0,3%Korrektur verfügbar

    Parse Server: MFA recovery code single-use bypass via concurrent requests

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.60 and 9.6.0-alpha.54, an attacker who obtains a user's password and a single MFA recovery code can reuse that recovery code an unlimited number of times by sending concurrent login requests. This defeats the single-use design of recovery codes. The attack requires the user's password, a valid recovery code, and the ability to send concurrent requests within milliseconds. This issue has been patched in versions 8.6.60 and 9.6.0-alpha.54.

    parse-server parse-serverNode.js
    • Auf 8.6.60 aktualisieren
    • Auf 9.6.0-alpha.54 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  6. CVE-2026-33539

    Hoch · CVSS 8.6EPSS 0,69%Korrektur verfügbar

    Parse Server: SQL injection via aggregate and distinct field names in PostgreSQL adapter

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.59 and 9.6.0-alpha.53, an attacker with master key access can execute arbitrary SQL statements on the PostgreSQL database by injecting SQL metacharacters into field name parameters of the aggregate $group pipeline stage or the distinct operation. This allows privilege escalation from Parse Server application-level administrator to PostgreSQL database-level access. Only Parse Server deployments using PostgreSQL are affected. MongoDB deployments are not affected. This issue has been patched in versions 8.6.59 and 9.6.0-a

    parse-server parse-serverNode.js
    • Auf 8.6.59 aktualisieren
    • Auf 9.6.0-alpha.53 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  7. CVE-2026-33538

    Hoch · CVSS 8.7EPSS 0,78%Korrektur verfügbar

    Parse Server: Denial of service via unindexed database query for unconfigured auth providers

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.58 and 9.6.0-alpha.52, an unauthenticated attacker can cause denial of service by sending authentication requests with arbitrary, unconfigured provider names. The server executes a database query for each unconfigured provider before rejecting the request, and since no database index exists for unconfigured providers, each request triggers a full collection scan on the user database. This can be parallelized to saturate database resources. This issue has been patched in versions 8.6.58 and 9.6.0-alpha.52.

    parse-server parse-serverNode.js
    • Auf 8.6.58 aktualisieren
    • Auf 9.6.0-alpha.52 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  8. CVE-2026-33527

    Mittel · CVSS 5.3EPSS 0,35%Korrektur verfügbar

    Parse Server: Session update endpoint allows overwriting server-generated session fields

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.57 and 9.6.0-alpha.48, an authenticated user can overwrite server-generated session fields such as expiresAt and createdWith when updating their own session via the REST API. This allows bypassing the server's configured session lifetime policy, making a session effectively permanent. This issue has been patched in versions 8.6.57 and 9.6.0-alpha.48.

    parse-server parse-serverNode.js
    • Auf 8.6.57 aktualisieren
    • Auf 9.6.0-alpha.48 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  9. CVE-2026-33508

    Hoch · CVSS 8.2EPSS 0,64%Korrektur verfügbar

    Parse Server: LiveQuery subscription query depth bypass

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.56 and 9.6.0-alpha.45, Parse Server's LiveQuery component does not enforce the requestComplexity.queryDepth configuration setting when processing WebSocket subscription requests. An attacker can send a subscription with deeply nested logical operators, causing excessive recursion and CPU consumption that degrades or disrupts service availability. This issue has been patched in versions 8.6.56 and 9.6.0-alpha.45.

    parse-server parse-serverNode.js
    • Auf 8.6.56 aktualisieren
    • Auf 9.6.0-alpha.45 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  10. CVE-2026-33498

    Hoch · CVSS 8.7EPSS 0,64%Korrektur verfügbar

    Parse Server: Query condition depth bypass via pre-validation transform pipeline

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.55 and 9.6.0-alpha.44, an attacker can send an unauthenticated HTTP request with a deeply nested query containing logical operators to permanently hang the Parse Server process. The server becomes completely unresponsive and must be manually restarted. This is a bypass of the fix for CVE-2026-32944. This issue has been patched in versions 8.6.55 and 9.6.0-alpha.44.

    parse-server parse-serverNode.js
    • Auf 8.6.55 aktualisieren
    • Auf 9.6.0-alpha.44 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  11. CVE-2026-33429

    Mittel · CVSS 6.3EPSS 0,43%Korrektur verfügbar

    Parse Server: Protected field change detection oracle via LiveQuery watch parameter

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.54 and 9.6.0-alpha.43, an attacker can subscribe to LiveQuery with a watch parameter targeting a protected field. Although the protected field value is properly stripped from event payloads, the presence or absence of update events reveals whether the protected field changed, creating a binary oracle. For boolean protected fields, the timing of change events is equivalent to knowing the field value. This issue has been patched in versions 8.6.54 and 9.6.0-alpha.43.

    parse-server parse-serverNode.js
    • Auf 8.6.54 aktualisieren
    • Auf 9.6.0-alpha.43 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  12. CVE-2026-33421

    Hoch · CVSS 7.1EPSS 0,46%Korrektur verfügbar

    Parse Server: LiveQuery bypasses CLP pointer permission enforcement

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.53 and 9.6.0-alpha.42, Parse Server's LiveQuery WebSocket interface does not enforce Class-Level Permission (CLP) pointer permissions (readUserFields and pointerFields). Any authenticated user can subscribe to LiveQuery events and receive real-time updates for all objects in classes protected by pointer permissions, regardless of whether the pointer fields on those objects point to the subscribing user. This bypasses the intended read access control, allowing unauthorized access to potentially sensitive data that is co

    parse-server parse-serverNode.js
    • Auf 8.6.53 aktualisieren
    • Auf 9.6.0-alpha.42 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  13. CVE-2026-33409

    Hoch · CVSS 7EPSS 0,58%Korrektur verfügbar

    Parse Server: Auth provider validation bypass on login via partial authData

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.52 and 9.6.0-alpha.41, an authentication bypass vulnerability allows an attacker to log in as any user who has linked a third-party authentication provider, without knowing the user's credentials. The attacker only needs to know the user's provider ID to gain full access to their account, including a valid session token. This affects Parse Server deployments where the server option allowExpiredAuthDataToken is set to true. The default value is false. This issue has been patched in versions 8.6.52 and 9.6.0-alpha.41.

    parse-server parse-serverNode.js
    • Auf 8.6.52 aktualisieren
    • Auf 9.6.0-alpha.41 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  14. CVE-2026-33323

    Mittel · CVSS 6.3EPSS 0,45%Korrektur verfügbar

    Parse Server: Email verification resend page leaks user existence

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return distinguishable responses depending on whether the provided username exists and has an unverified email. This allows an unauthenticated attacker to enumerate valid usernames by observing different redirect targets. The existing emailVerifySuccessOnInvalidEmail configuration option, which is enabled by default and protects the API route against this, did not apply to these routes. This issue has been patched i

    parse-server parse-serverNode.js
    • Auf 8.6.51 aktualisieren
    • Auf 9.6.0-alpha.40 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  15. CVE-2026-33163

    Hoch · CVSS 8.2EPSS 0,52%Korrektur verfügbar

    Parse Server leaks protected fields via LiveQuery afterEvent trigger

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.35 and 8.6.50, when a `Parse.Cloud.afterLiveQueryEvent` trigger is registered for a class, the LiveQuery server leaks protected fields and `authData` to all subscribers of that class. Fields configured as protected via Class-Level Permissions (`protectedFields`) are included in LiveQuery event payloads for all event types (create, update, delete, enter, leave). Any user with sufficient CLP permissions to subscribe to the affected class can receive protected field data of other users, including sensitive personal informa

    parse-server parse-serverNode.js
    • Auf 8.6.50 aktualisieren
    • Auf 9.6.0-alpha.35 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  16. CVE-2026-33042

    Mittel · CVSS 6.9EPSS 0,39%Korrektur verfügbar

    Parse Server affected by empty authData bypassing credential requirement on signup

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.29 and 8.6.49, a user can sign up without providing credentials by sending an empty `authData` object, bypassing the username and password requirement. This allows the creation of authenticated sessions without proper credentials, even when anonymous users are disabled. The fix in 9.6.0-alpha.29 and 8.6.49 ensures that empty or non-actionable `authData` is treated the same as absent `authData` for the purpose of credential validation on new user creation. Username and password are now required when no valid auth provide

    parse-server parse-serverNode.js
    • Auf 8.6.49 aktualisieren
    • Auf 9.6.0-alpha.29 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  17. CVE-2026-32944

    Hoch · CVSS 8.7EPSS 0,63%Korrektur verfügbar

    Parse Server crash via deeply nested query condition operators

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.21 and 8.6.45, an unauthenticated attacker can crash the Parse Server process by sending a single request with deeply nested query condition operators. This terminates the server and denies service to all connected clients. Starting in version 9.6.0-alpha.21 and 8.6.45, a depth limit for query condition operator nesting has been added via the `requestComplexity.queryDepth` server option. The option is disabled by default to avoid a breaking change. To mitigate, upgrade and set the option to a value appropriate for your

    parse-server parse-serverNode.js
    • Auf 8.6.45 aktualisieren
    • Auf 9.6.0-alpha.21 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  18. CVE-2026-32943

    Niedrig · CVSS 2.3EPSS 0,26%Korrektur verfügbar

    Parse Server has a password reset token single-use bypass via concurrent requests

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.28 and 8.6.48, the password reset mechanism does not enforce single-use guarantees for reset tokens. When a user requests a password reset, the generated token can be consumed by multiple concurrent requests within a short time window. An attacker who has intercepted a password reset token can race the legitimate user's password reset request, causing both requests to succeed. This may result in the legitimate user believing their password was changed successfully while the attacker's password takes effect instead. All

    parse-server parse-serverNode.js
    • Auf 8.6.48 aktualisieren
    • Auf 9.6.0-alpha.28 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  19. CVE-2026-32886

    Hoch · CVSS 8.2EPSS 0,74%Korrektur verfügbar

    Parse Server's Cloud function dispatch crashes server via prototype chain traversal

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. The fix in versions 9.6.0-alpha.24 and 8.6.47 restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. There is no known workaround.

    parse-server parse-serverNode.js
    • Auf 8.6.47 aktualisieren
    • Auf 9.6.0-alpha.24 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

  20. CVE-2026-32878

    Mittel · CVSS 5.3EPSS 0,52%Korrektur verfügbar

    Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.20 and 8.6.44, an attacker can bypass the default request keyword denylist protection and the class-level permission for adding fields by sending a crafted request that exploits prototype pollution in the deep copy mechanism. This allows injecting fields into class schemas that have field addition locked down, and can cause permanent schema type conflicts that cannot be resolved even with the master key. In 9.6.0-alpha.20 and 8.6.44, the vulnerable third-party deep copy library has been replaced with a built-in deep clo

    parse-server parse-serverNode.js
    • Auf 8.6.44 aktualisieren
    • Auf 9.6.0-alpha.20 aktualisieren
    Veröffentlicht Aktualisiert
    Originalmeldung 1 ↗Originalmeldung 2 ↗Originalmeldung 3 ↗

Prüfen Sie Ihren Server

Gleichen Sie Ihren installierten Stack und seine Versionen mit den aktuellen Sicherheitsmeldungen ab.

Prüfen Sie Ihren Server →