parse-server vulnerabilities
CVEs whose affected-version data names the parse-server package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
35 CVEsRSS
CVE-2026-34573High· 7.5Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.68 and 9.7.0-alpha.12, the GraphQL query complexity validator can be exploited to cause a denial-of-service by …
CVE-2026-34532Critical· 9.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.67 and 9.7.0-alpha.11, an attacker can bypass Cloud Function validator access controls by appending "prototype.…
CVE-2026-32594MediumParse Server's GraphQL WebSocket endpoint bypasses security middleware
Parse Server's GraphQL WebSocket endpoint bypasses security middleware
CVE-2025-68115Medium· 6.1Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflected Cross-Site Scripting (XSS) vulnerability exists in Parse Server's password …
CVE-2025-67727Critical· 9.8PoCParse Server is an open source backend that can be deployed to any infrastructure that runs Node.js
Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow is triggered in a way that grants the GitHub Actions workflow elevated permissi…