Description
If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).
Recommendation
Update the parse-server package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.4.1
- Patched version(s): 3.4.1
References
- GHSA-2479-qvv7-47qq
- snyk.io
- www.npmjs.com
- CVE-2019-1020012
- CWE-444
- CAPEC-310
- OWASP 2021-A4
- OWASP 2021-A6
Related Issues
- Parse Server: Pre-authentication denial of service via client version header regex backtracking - CVE-2026-47138
- Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939
- Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API - CVE-2026-30946
- Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery - CVE-2026-30925
You might also like:
- Tags:
- npm
- parse-server
Anything's wrong? Let us know
Last updated on January 08, 2023