parse-server
8.6.123Parse Server for Node.js / Express
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 30 advisories2 critical, 7 high, 10 medium, 11 low · Scorecard 7.2/10
- Supported versions
- No scheduleendoflife.date does not track this project
21.4k stars · 4.8k forks · 602 open issues · last release 5 days ago · data checked 54 minutes ago
Security advisories
All advisories on GitHubThe 30 most recent advisories published by the maintainers: 2 critical, 7 high, 10 medium, 11 low. Check the patched version against the one you run.
- mediumGHSA-43rg-r2xr-q686Nov 14, 2026Login with auth data discloses MFA secrets and user fields that the user is not allowed to read
- Affected
- < 9.12.0-alpha.3
- Patched in
- 9.12.0-alpha.3
- highGHSA-f6wh-8wcf-xfv8Nov 11, 2026LiveQuery subscription with a large list constraint can block the event loop
- Affected
- < 9.12.0-alpha.2
- Patched in
- 9.12.0-alpha.2
- criticalGHSA-r66f-3q22-grc4Nov 9, 2026Google Play Games auth adapter accepts a player ID that the access token does not belong to
- Affected
- >= 9.0.0, < 9.11.1-alpha.4; >= 3.10.0, < 8.6.123
- Patched in
- 9.11.1-alpha.4; 8.6.123
- lowGHSA-wq62-rjpm-q29hNov 5, 2026Object write with a dot notation key can change a field that a `beforeSave` trigger reverts or keeps constant
- Affected
- >= 9.0.0, < 9.11.1-alpha.2; <= 8.6.121
- Patched in
- 9.11.1-alpha.2; 8.6.122
- highGHSA-2rxj-6v32-2v6jNov 4, 2026Object update with a dot notation key can terminate the server process when the class has a beforeSave trigger
- Affected
- >= 9.0.0, < 9.11.1-alpha.1; <= 8.6.120
- Patched in
- 9.11.1-alpha.1; 8.6.121
- mediumGHSA-q2gf-q36j-h978Oct 30, 2026LiveQuery subscriptions can receive installations and objects of other internal classes without the master key
- Affected
- >= 9.0.0, < 9.10.8-alpha.3; <= 8.6.118
- Patched in
- 9.10.8-alpha.3; 8.6.119
- lowGHSA-4m87-fqwv-2m8vOct 29, 2026Dot notation operation on a missing field reveals whether the field is stored to a caller without read access
- Affected
- >= 9.10.6-alpha.1, < 9.10.8-alpha.1; >= 8.6.109, < 8.6.118
- Patched in
- 9.10.8-alpha.1; 8.6.118
- lowGHSA-ch64-8phh-m7hcOct 23, 2026Save response reveals whether a field is stored to a caller without read access
- Affected
- >= 9.10.6-alpha.1, < 9.10.7-alpha.2; >= 8.6.109, < 8.6.116
- Patched in
- 9.10.7-alpha.2; 8.6.116
- highGHSA-9492-427f-466xOct 22, 2026Pre-authentication denial of service via email address format regex backtracking
- Affected
- >= 9.0.0, < 9.10.7-alpha.1; < 8.6.115
- Patched in
- 9.10.7-alpha.1; 8.6.115
- lowGHSA-qq3r-ppqq-rh6mOct 21, 2026Object create returns field values to a caller without read access
- Affected
- >= 9.0.0, < 9.10.6-alpha.6; < 8.6.114
- Patched in
- 9.10.6-alpha.6; 8.6.114
- mediumGHSA-95hp-82c6-25q5Oct 20, 2026Object write with a crafted dot notation key can pollute a shared prototype when the class has a trigger or LiveQuery
- Affected
- >= 9.0.0, < 9.10.6-alpha.5; < 8.6.113
- Patched in
- 9.10.6-alpha.5; 8.6.113
- lowGHSA-2j2x-c587-q33gOct 20, 2026Session upgrade endpoint creates an additional session from an already revocable session token
- Affected
- >= 9.0.0, < 9.10.6-alpha.4; < 8.6.112
- Patched in
- 9.10.6-alpha.4; 8.6.112
- mediumGHSA-655c-2xf3-77x9Oct 19, 2026Object write with a null dot notation key can corrupt a field or make reads fail on MongoDB
- Affected
- >= 9.0.0, < 9.10.6-alpha.3; <= 8.6.110
- Patched in
- 9.10.6-alpha.3; 8.6.111
- highGHSA-wc3c-6843-q7mvOct 19, 2026Object update with a dot notation key below a pointer field can terminate the server process
- Affected
- >= 9.0.0, < 9.10.6-alpha.2; <= 8.6.109
- Patched in
- 9.10.6-alpha.2; 8.6.110
- lowGHSA-2rcp-jc67-vq74Oct 18, 2026Object update returns stored field values to a caller without read access
- Affected
- >= 9.0.0, < 9.10.6-alpha.1; < 8.6.109
- Patched in
- 9.10.6-alpha.1; 8.6.109
- mediumGHSA-8j8q-73xx-w3m4Oct 15, 2026Installation update is written to the installation named by the request's installation ID instead of the addressed object
- Affected
- >= 9.7.0, < 9.10.5-alpha.10
- Patched in
- 9.10.5-alpha.10
- mediumGHSA-rx55-fw4j-pvpxOct 15, 2026Object write with a crafted key can pollute a shared prototype and cause denial of service
- Affected
- >= 9.0.0, < 9.10.5-alpha.9; < 8.6.108
- Patched in
- 9.10.5-alpha.9; 8.6.108
- lowGHSA-6mfr-rv66-x7m3Oct 15, 2026Save response includes protected field values that a `beforeSave` trigger writes in dot notation
- Affected
- >= 9.7.0, < 9.10.5-alpha.7
- Patched in
- 9.10.5-alpha.7
- lowGHSA-9rvr-f5hc-9f2fOct 15, 2026Object update returns the stored value of a field reverted in `beforeSave` to a caller without read access
- Affected
- >= 9.0.0, < 9.10.5-alpha.8; < 8.6.107
- Patched in
- 9.10.5-alpha.8; 8.6.107
- lowGHSA-969q-274f-mc7wOct 14, 2026Object write with a dot notation key can skip `afterSave` triggers and LiveQuery events
- Affected
- >= 9.0.0, < 9.10.5-alpha.7; < 8.6.106
- Patched in
- 9.10.5-alpha.7; 8.6.106
- mediumGHSA-58m4-cqvw-4vghOct 11, 2026Relation `$relatedTo` query using an operator instead of an object ID bypasses owning-object ACL
- Affected
- >= 9.0.0, < 9.10.5-alpha.6; < 8.6.105
- Patched in
- 9.10.5-alpha.6; 8.6.105
- lowGHSA-9rh6-r4ph-367vOct 11, 2026SMS MFA login code request saves other login request fields with master privileges
- Affected
- >= 9.0.0, < 9.10.5-alpha.5; < 8.6.104
- Patched in
- 9.10.5-alpha.5; 8.6.104
- mediumGHSA-349r-988w-x3jpOct 10, 2026LiveQuery subscriptions using a `$or` query can receive another user's events, including session tokens
- Affected
- >= 9.0.0, < 9.10.5-alpha.4; <= 8.6.102
- Patched in
- 9.10.5-alpha.4; 8.6.103
- criticalGHSA-rq3w-5c6f-p7wrOct 10, 2026Custom auth adapters that extend the AuthAdapter class accept any authData
- Affected
- >= 9.0.0, < 9.10.5-alpha.2; < 8.6.102
- Patched in
- 9.10.5-alpha.2; 8.6.102
- highGHSA-qmg9-m772-5rm7Oct 8, 2026Unauthenticated deletion of class schemas removes class-level permissions on MongoDB
- Affected
- >= 9.0.0, < 9.10.4-alpha.4; < 8.6.101
- Patched in
- 9.10.4-alpha.4; 8.6.101
- mediumGHSA-gwrq-q25v-g8mrOct 8, 2026Object write with a reserved field name can make reads fail on MongoDB
- Affected
- >= 9.0.0, < 9.10.4-alpha.3; < 8.6.100
- Patched in
- 9.10.4-alpha.3; 8.6.100
- mediumGHSA-p49q-9w65-f9p7Oct 5, 2026User update runs checks against the target account before authorization
- Affected
- >= 9.0.0, < 9.10.3-alpha.2; < 8.6.99
- Patched in
- 9.10.3-alpha.2; 8.6.99
- lowGHSA-gj37-5hg5-p729Oct 4, 2026Session creation endpoint bypasses create and addField class-level permissions
- Affected
- >= 9.0.0, < 9.10.3-alpha.1; < 8.6.98
- Patched in
- 9.10.3-alpha.1; 8.6.98
- highGHSA-46jj-qw3p-48fcSep 30, 2026Server crash via unhandled error when sending verification or password reset email
- Affected
- >= 9.0.0, < 9.10.2-alpha.6; < 8.6.97
- Patched in
- 9.10.2-alpha.6; 8.6.97
- highGHSA-jhh9-hrgh-c9gvSep 28, 2026Transactional batch request can roll back or block writes of other clients
- Affected
- >= 9.0.0, < 9.10.2-alpha.5; >= 5.4.0, < 8.6.96
- Patched in
- 9.10.2-alpha.5; 8.6.96