Parse Server before v3.4.1 vulnerable to Denial of Service

Description

If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.4.1
• Patched version(s): 3.4.1

References

• GHSA-2479-qvv7-47qq
• snyk.io
• www.npmjs.com
• CVE-2019-1020012
• CWE-444
• CAPEC-310
• OWASP 2021-A4
• OWASP 2021-A6

Related Issues

• Parse Server may crash when uploading file without extension - CVE-2023-46119
• @digitalocean/do-markdownit has Type Confusion vulnerability - CVE-2025-59717
• useragent Regular Expression Denial of Service vulnerability - CVE-2020-26311
• Parse Server exposes the data schema via GraphQL API - CVE-2025-53364

Tags:

npm

parse-server