Parse Server: Denial of Service via unindexed database query for unconfigured auth providers

Description

An unauthenticated attacker can cause Denial of Service by sending authentication requests with arbitrary, unconfigured provider names.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **< 8.6.58

  >= 9.0.0, < 9.6.0-alpha.52**

• Patched version(s): **8.6.58

  9.6.0-alpha.52**

References

• GHSA-g4cf-xj29-wqqr
• CVE-2026-33538
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery - CVE-2026-30925
• Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API - CVE-2026-30946
• Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939
• Parse Server exposes auth data via /users/me endpoint - CVE-2026-33627

Tags:

npm

parse-server