parse-community-parse-server

Adapters/Auth

fix: OAuth2 adapter app ID validation sends wrong token to introspection endpoint ([GHSA-69xg-f649-w5g2](https://github.com/parse-community/parse-server/security/advisories/GHSA-69xg-f649-w5g2 )) (#10188 )

2026-03-11 23:47:44 +00:00

cloud

…

configs

…

dependencies

…

support

…

.babelrc

…

AccountLockoutPolicy.spec.js

…

AdaptableController.spec.js

…

AdapterLoader.spec.js

…

AggregateRouter.spec.js

…

Analytics.spec.js

…

AudienceRouter.spec.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10152 )

2026-03-09 03:41:25 +00:00

Auth.spec.js

…

AuthDataUniqueIndex.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10150 )

2026-03-09 02:05:49 +00:00

AuthenticationAdapters.spec.js

fix: MFA recovery codes not consumed after use ([GHSA-4hf6-3x24-c9m8](https://github.com/parse-community/parse-server/security/advisories/GHSA-4hf6-3x24-c9m8 )) (#10171 )

2026-03-10 04:22:30 +00:00

AuthenticationAdaptersV2.spec.js

…

batch.spec.js

…

buildConfigDefinitions.spec.js

…

CacheController.spec.js

…

CLI.spec.js

…

Client.spec.js

…

ClientSDK.spec.js

…

CloudCode.spec.js

…

CloudCode.Validator.spec.js

…

CloudCodeLogger.spec.js

…

cryptoUtils.spec.js

…

DatabaseController.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10150 )

2026-03-09 02:05:49 +00:00

defaultGraphQLTypes.spec.js

…

DefinedSchemas.spec.js

…

Deprecator.spec.js

…

EmailVerificationToken.spec.js

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856 )) (#10173 )

2026-03-10 13:59:30 +00:00

EnableExpressErrorHandler.spec.js

…

eslint.config.js

…

EventEmitterPubSub.spec.js

…

features.spec.js

…

FilesController.spec.js

…

graphQLObjectsQueries.js

…

GraphQLQueryComplexity.spec.js

fix: Denial-of-service via unbounded query complexity in REST and GraphQL API ([GHSA-cmj3-wx7h-ffvg](https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg )) (#10131 )

2026-03-07 23:33:27 +00:00

GridFSBucketStorageAdapter.spec.js

…

helper.js

fix: Parse Server role escalation and CLP bypass via direct `_Join table write ([GHSA-5f92-jrq3-28rc](https://github.com/parse-community/parse-server/security/advisories/GHSA-5f92-jrq3-28rc )) (#10142 )

2026-03-08 16:26:52 +00:00

HTTPRequest.spec.js

…

Idempotency.spec.js

…

index.spec.js

fix: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters ([GHSA-x6fw-778m-wr9v](https://github.com/parse-community/parse-server/security/advisories/GHSA-x6fw-778m-wr9v )) (#10114 )

2026-03-06 05:12:09 +00:00

InMemoryCache.spec.js

…

InMemoryCacheAdapter.spec.js

…

InstallationsRouter.spec.js

…

JobSchedule.spec.js

…

LdapAuth.spec.js

fix: LDAP injection via unsanitized user input in DN and group filter construction ([GHSA-7m6r-fhh7-r47c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7m6r-fhh7-r47c )) (#10153 )

2026-03-09 14:04:08 +00:00

Logger.spec.js

…

LoggerController.spec.js

…

LogsRouter.spec.js

…

Middlewares.spec.js

…

MongoSchemaCollectionAdapter.spec.js

…

MongoStorageAdapter.spec.js

…

MongoTransform.spec.js

fix: NoSQL injection via token type in password reset and email verification endpoints ([GHSA-vgjh-hmwf-c588](https://github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588 )) (#10129 )

2026-03-07 19:16:26 +00:00

NullCacheAdapter.spec.js

…

OAuth1.spec.js

…

PagesRouter.spec.js

fix: Reject invalid locale format in PagesRouter (#10282 )

2026-03-22 17:33:10 +00:00

Parse.Push.spec.js

…

ParseACL.spec.js

…

ParseAPI.spec.js

…

ParseCloudCodePublisher.spec.js

…

ParseConfigKey.spec.js

…

ParseFile.spec.js

fix: Stored cross-site scripting (XSS) via SVG file upload ([GHSA-hcj7-6gxh-24ww](https://github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww )) (#10135 )

2026-03-08 02:05:07 +00:00

ParseGeoPoint.spec.js

…

ParseGlobalConfig.spec.js

…

ParseGraphQLClassNameTransformer.spec.js

…

ParseGraphQLController.spec.js

…

ParseGraphQLSchema.spec.js

…

ParseGraphQLServer.spec.js

fix: GraphQL WebSocket endpoint bypasses security middleware ([GHSA-p2x3-8689-cwpg](https://github.com/parse-community/parse-server/security/advisories/GHSA-p2x3-8689-cwpg )) (#10190 )

2026-03-12 14:24:06 +00:00

ParseHooks.spec.js

…

ParseInstallation.spec.js

…

ParseLiveQuery.spec.js

fix: LiveQuery subscription with invalid regular expression crashes server ([GHSA-827p-g5x5-h86c](https://github.com/parse-community/parse-server/security/advisories/GHSA-827p-g5x5-h86c )) (#10199 )

2026-03-14 14:21:52 +01:00

ParseLiveQueryRedis.spec.js

…

ParseLiveQueryServer.spec.js

fix: Bypass of class-level permissions in LiveQuery ([GHSA-7ch5-98q2-7289](https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 )) (#10134 )

2026-03-08 01:15:17 +00:00

ParseObject.spec.js

…

ParsePolygon.spec.js

…

ParsePubSub.spec.js

…

ParseQuery.Aggregate.spec.js

…

ParseQuery.Comment.spec.js

…

ParseQuery.FullTextSearch.spec.js

…

ParseQuery.hint.spec.js

…

ParseQuery.spec.js

…

ParseRelation.spec.js

…

ParseRole.spec.js

…

parsers.spec.js

…

ParseServer.spec.js

…

ParseServerRESTController.spec.js

…

ParseSession.spec.js

fix: Session update endpoint allows overwriting server-generated session fields ([GHSA-jc39-686j-wp6q](https://github.com/parse-community/parse-server/security/advisories/GHSA-jc39-686j-wp6q )) (#10264 )

2026-03-21 01:37:55 +00:00

ParseUser.spec.js

fix: Concurrent signup with same authentication creates duplicate users (#10150 )

2026-03-09 02:05:49 +00:00

ParseWebSocket.spec.js

…

ParseWebSocketServer.spec.js

…

PasswordPolicy.spec.js

…

PointerPermissions.spec.js

…

PostgresConfigParser.spec.js

…

PostgresInitOptions.spec.js

…

PostgresStorageAdapter.spec.js

…

PromiseRouter.spec.js

…

ProtectedFields.spec.js

fix: Protected fields bypass via logical query operators ([GHSA-72hp-qff8-4pvv](https://github.com/parse-community/parse-server/security/advisories/GHSA-72hp-qff8-4pvv )) (#10139 )

2026-03-08 15:25:37 +00:00

PublicAPI.spec.js

…

PurchaseValidation.spec.js

…

PushController.spec.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10152 )

2026-03-09 03:41:25 +00:00

PushQueue.spec.js

…

PushRouter.spec.js

…

PushWorker.spec.js

…

QueryTools.spec.js

fix: LiveQuery subscription with invalid regular expression crashes server ([GHSA-827p-g5x5-h86c](https://github.com/parse-community/parse-server/security/advisories/GHSA-827p-g5x5-h86c )) (#10199 )

2026-03-14 14:21:52 +01:00

RateLimit.spec.js

fix: Rate limit bypass via batch request endpoint ([GHSA-775h-3xrc-c228](https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228 )) (#10148 )

2026-03-08 20:30:42 +00:00

ReadPreferenceOption.spec.js

…

RedisCacheAdapter.spec.js

…

RedisPubSub.spec.js

…

RegexVulnerabilities.spec.js

fix: Account takeover via operator injection in authentication data identifier ([GHSA-5fw2-8jcv-xh87](https://github.com/parse-community/parse-server/security/advisories/GHSA-5fw2-8jcv-xh87 )) (#10186 )

2026-03-11 18:07:21 +00:00

RequestComplexity.spec.js

fix: Revert accidental breaking default values for query complexity limits (#10206 )

2026-03-15 03:34:04 +00:00

rest.spec.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10152 )

2026-03-09 03:41:25 +00:00

RestQuery.spec.js

fix: Parse Server session token exfiltration via redirectClassNameForKey query parameter ([GHSA-6r2j-cxgf-495f](https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f )) (#10144 )

2026-03-08 17:23:47 +00:00

RevocableSessionsUpgrade.spec.js

…

Schema.spec.js

…

SchemaPerformance.spec.js

…

schemas.spec.js

…

SecurityCheck.spec.js

fix: Regular Expression Denial of Service (ReDoS) via $regex query in LiveQuery ([GHSA-mf3j-86qx-cq5j](https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j )) (#10120 )

2026-03-07 02:14:34 +00:00

SecurityCheckGroups.spec.js

fix: Revert accidental breaking default values for query complexity limits (#10206 )

2026-03-15 03:34:04 +00:00

SessionTokenCache.spec.js

…

Subscription.spec.js

…

Uniqueness.spec.js

…

UserController.spec.js

…

UserPII.spec.js

…

Utils.spec.js

…

ValidationAndPasswordsReset.spec.js

fix: Email verification resend page leaks user existence (GHSA-h29g-q5c2-9h4f) (#10243 )

2026-03-19 02:09:14 +00:00

VerifyUserPassword.spec.js

…

vulnerabilities.spec.js

fix: LiveQuery protected field leak via shared mutable state across concurrent subscribers ([GHSA-m983-v2ff-wq65](https://github.com/parse-community/parse-server/security/advisories/GHSA-m983-v2ff-wq65 )) (#10331 )

2026-03-27 13:44:20 +00:00

WinstonLoggerAdapter.spec.js

…