Server crashes on invalid Cloud Function or Cloud Job name

Description

Calling an invalid Parse Server Cloud Function name or Cloud Job name crashes server and may allow for code injection.

Recommendation

Update the parse-server package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 7.0.0-alpha.1, < 7.0.0-alpha.29

  < 6.5.5**

• Patched version(s): **7.0.0-alpha.29

  6.5.5**

References

• GHSA-6hh7-46r2-vf29
• CVE-2024-29027
• CWE-20
• CWE-74
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Parse Server's Cloud function dispatch crashes server via prototype chain traversal - CVE-2026-32886
• Parse Server LiveQuery subscription with invalid regular expression crashes server - CVE-2026-32770
• parse-server crashes when receiving file download request with invalid byte range - CVE-2022-39313
• Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939

Tags:

npm

parse-server