parse-server crashes when receiving file download request with invalid byte range

Description

Parse Server crashes when a file download request is received with an invalid byte range.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.2.8

  < 4.10.17**

• Patched version(s): **5.2.8

  4.10.17**

References

• GHSA-h423-w6qv-2wj3
• CVE-2022-39313
• CWE-1284
• CWE-20
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Invalid file request can crash server - CVE-2022-31089
• Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format - CVE-2025-64430
• Parse Server may crash when uploading file without extension - CVE-2023-46119
• Command injection in Parse Server through prototype pollution - CVE-2022-24760

Tags:

npm

parse-server