Description
Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch.
Recommendation
Update the parse-server package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.10.3
- Patched version(s): 4.10.3
References
- GHSA-xqp8-w826-hh6x
- jira.mongodb.org
- CVE-2021-39187
- CWE-20
- CWE-74
- CWE-755
- CAPEC-310
- OWASP 2021-A3
- OWASP 2021-A6
Related Issues
- Sensitive Data Exposure in parse-server - CVE-2019-1020013
- Prebid.js NPM package briefly compromised - CVE-2025-59038
- Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
- devalue prototype pollution vulnerability - CVE-2025-57820
- Tags:
- npm
- parse-server
Anything's wrong? Let us know Last updated on January 30, 2023