Parse Server before v3.4.1 vulnerable to Denial of Service

Description

If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.4.1
• Patched version(s): 3.4.1

References

• GHSA-2479-qvv7-47qq
• snyk.io
• www.npmjs.com
• CVE-2019-1020012
• CWE-444
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery - CVE-2026-30925
• Parse Server: Denial of Service via unindexed database query for unconfigured auth providers - CVE-2026-33538
• Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API - CVE-2026-30946
• Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939

Tags:

npm

parse-server