Description
Parse Server LiveQuery does not remove protected fields in classes, passing them to the client.
Recommendation
Update the parse-server package to the latest compatible version. Followings are version details:
Affected version(s): **>= 5.0.0, < 5.2.4 < 4.10.13** Patched version(s): **5.2.4 4.10.13**
References
Related Issues
- Parse Server allows public `explain` queries which may expose sensitive database performance information and schema deta - CVE-2025-64502
- Elliptic allows BER-encoded signatures - CVE-2024-42461
- Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
- Parse Server exposes the data schema via GraphQL API - CVE-2025-53364
- Tags:
- npm
- parse-server
Anything's wrong? Let us know Last updated on July 24, 2023