Security: parse-community/parse-server
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
File upload Content-Type override via extension mismatchGHSA-vr5f-2r24-w5hc published
Apr 2, 2026 by mtrezzaLow -
LiveQuery protected-field guard bypass via array-like logical operator valueGHSA-mmg8-87c5-jrc2 published
Mar 29, 2026 by mtrezzaModerate -
Session field immutability bypass via falsy-value guardGHSA-f6j3-w9v3-cq22 published
Mar 29, 2026 by mtrezzaModerate -
Cloud function validator bypass via prototype chain traversalGHSA-vpj2-qq7w-5qq6 published
Mar 28, 2026 by mtrezzaCritical -
GraphQL complexity validator exponential fragment traversal DoSGHSA-mfj6-6p54-m98c published
Mar 29, 2026 by mtrezzaHigh -
GraphQL API endpoint ignores CORS origin restrictionGHSA-q3p6-g7c4-829c published
Mar 27, 2026 by mtrezzaModerate -
LiveQuery protected field leak via shared mutable state across concurrent subscribersGHSA-m983-v2ff-wq65 published
Mar 27, 2026 by mtrezzaHigh -
MFA single-use token bypass via concurrent authData login requestsGHSA-w73w-g5xw-rwhf published
Mar 26, 2026 by mtrezzaLow -
Auth data exposed via verify password endpointGHSA-wp76-gg32-8258 published
Mar 26, 2026 by mtrezzaHigh -
MFA recovery code single-use bypass via concurrent requestsGHSA-2299-ghjr-6vjp published
Mar 22, 2026 by mtrezzaLow