Parse Server before v3.4.1 vulnerable to Denial of Service

Description

If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.4.1
• Patched version(s): 3.4.1

References

• GHSA-2479-qvv7-47qq
• snyk.io
• www.npmjs.com
• CVE-2019-1020012
• CWE-444
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Parse Server may crash when uploading file without extension - CVE-2023-46119
• Parse Server exposes the data schema via GraphQL API - CVE-2025-53364
• node-opcua-alarm-condition prototype pollution vulnerability - CVE-2024-57086
• Parse Server has an OAuth login vulnerability - CVE-2025-30168

Tags:

npm

parse-server