Incorrect version tags linked to external repository

Description

A security incident caused a number of incorrect version tags to be pushed to the Parse Server repository. These version tags linked to a personal fork of a contributor who had write access to the repository. The code to which these tags linked has not been reviewed or approved by Parse Platform.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.6.0, < 4.10.0

  >= 4.0.0, < 4.5.2**

• Patched version(s): **4.10.0

  4.5.2**

References

• GHSA-593v-wcqx-hq2w

Related Issues

• receiving subscription objects with deleted session - CVE-2020-15270
• Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter - CVE-2025-68150
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• url-parse Incorrectly parses URLs that include an '@ - CVE-2022-0639

Tags:

npm

parse-server