Invalid file request can crash server

Description

Certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as a single instance without redundancy, the availability impact may be high.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.2.3

  < 4.10.12**

• Patched version(s): **5.2.3

  4.10.12**

References

• GHSA-xw6g-jjvf-wwf9
• CVE-2022-31089
• CWE-252
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Information disclosure in parse-server - CVE-2020-5251
• Parse Server exposes the data schema via GraphQL API - CVE-2025-53364
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• Parse Server has an OAuth login vulnerability - CVE-2025-30168

Tags:

npm

parse-server