parse-community-parse-server

Adapters

fix: Missing audience validation in Keycloak authentication adapter ([GHSA-48mh-j4p5-7j9v](https://github.com/parse-community/parse-server/security/advisories/GHSA-48mh-j4p5-7j9v )) (#10138 )

2026-03-08 03:50:20 +00:00

cli

refactor: Add lint rules for no unused vars and unused import (#9940 )

2025-11-22 22:12:34 +01:00

cloud-code

feat: Add beforePasswordResetRequest hook (#9906 )

2025-11-19 14:57:28 +01:00

Controllers

fix: Malformed $regex query leaks database error details in API response (GHSA-9cp7-3q5w-j92g) (#10102 )

2026-03-05 20:45:39 +00:00

Deprecator

fix: Deprecation warning logged at server launch for nested Parse Server option even if option is explicitly set (#9934 )

2025-11-17 19:43:32 +01:00

GraphQL

fix: Denial-of-service via unbounded query complexity in REST and GraphQL API ([GHSA-cmj3-wx7h-ffvg](https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg )) (#10131 )

2026-03-07 23:33:27 +00:00

LiveQuery

fix: Bypass of class-level permissions in LiveQuery ([GHSA-7ch5-98q2-7289](https://github.com/parse-community/parse-server/security/advisories/GHSA-7ch5-98q2-7289 )) (#10134 )

2026-03-08 01:15:17 +00:00

Options

fix: Stored cross-site scripting (XSS) via SVG file upload ([GHSA-hcj7-6gxh-24ww](https://github.com/parse-community/parse-server/security/advisories/GHSA-hcj7-6gxh-24ww )) (#10135 )

2026-03-08 02:05:07 +00:00

Push

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Routers

fix: NoSQL injection via token type in password reset and email verification endpoints ([GHSA-vgjh-hmwf-c588](https://github.com/parse-community/parse-server/security/advisories/GHSA-vgjh-hmwf-c588 )) (#10129 )

2026-03-07 19:16:26 +00:00

SchemaMigrations

feat: Add option keepUnknownIndexes to retain indexes which are not specified in schema (#9857 )

2025-10-03 14:35:34 +02:00

Security

fix: Denial-of-service via unbounded query complexity in REST and GraphQL API ([GHSA-cmj3-wx7h-ffvg](https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg )) (#10131 )

2026-03-07 23:33:27 +00:00

vendor

refactor: Upgrade to eslint 9.19.0 (#9580 )

2025-02-01 15:32:43 +01:00

AccountLockout.js

refactor: replace hardcoded error codes with references (#7546 )

2021-10-18 20:19:47 +02:00

Auth.js

fix: Authentication provider credentials are usable across Parse Server apps; fixes security vulnerability [GHSA-837q-jhwx-cmpv](https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv ) (#9667 )

2025-03-21 10:49:09 +01:00

batch.js

refactor: Add lint rules for no unused vars and unused import (#9940 )

2025-11-22 22:12:34 +01:00

cache.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

ClientSDK.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Config.js

fix: Denial-of-service via unbounded query complexity in REST and GraphQL API ([GHSA-cmj3-wx7h-ffvg](https://github.com/parse-community/parse-server/security/advisories/GHSA-cmj3-wx7h-ffvg )) (#10131 )

2026-03-07 23:33:27 +00:00

cryptoUtils.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

defaults.js

fix: GridFSBucketAdapter throws when using some Parse Server specific options in MongoDB database options (#9915 )

2025-11-08 18:41:45 +01:00

deprecated.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Error.js

fix: Malformed $regex query leaks database error details in API response (GHSA-9cp7-3q5w-j92g) (#10102 )

2026-03-05 20:45:39 +00:00

index.ts

feat: Add TypeScript definitions (#9693 )

2025-04-15 12:59:58 +01:00

KeyPromiseQueue.js

Add KeyPromiseQueue to Push and Job StatusHandlers (#7267 )

2021-03-15 18:51:46 -05:00

logger.ts

feat: Add TypeScript support (#9550 )

2025-01-30 01:45:35 +01:00

middlewares.js

feat: Add Parse Server option enableSanitizedErrorResponse to remove detailed error messages from responses sent to clients (#9944 )

2025-11-28 19:48:35 +01:00

Page.js

Add page localization (#7128 )

2021-02-09 14:03:57 +01:00

ParseMessageQueue.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseServer.ts

fix: Regular Expression Denial of Service (ReDoS) via $regex query in LiveQuery ([GHSA-mf3j-86qx-cq5j](https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j )) (#10120 )

2026-03-07 02:14:34 +00:00

ParseServerRESTController.js

feat: Upgrade Parse JS SDK from 6.0.0 to 6.1.0 (#9686 )

2025-04-02 00:09:53 +01:00

password.js

refactor: Add lint rules for no unused vars and unused import (#9940 )

2025-11-22 22:12:34 +01:00

PromiseRouter.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

request.js

refactor: Add lint rules for no unused vars and unused import (#9940 )

2025-11-22 22:12:34 +01:00

requiredParameter.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

rest.js

feat: Add Parse Server option enableSanitizedErrorResponse to remove detailed error messages from responses sent to clients (#9944 )

2025-11-28 19:48:35 +01:00

RestQuery.js

fix: Parse Server session token exfiltration via redirectClassNameForKey query parameter ([GHSA-6r2j-cxgf-495f](https://github.com/parse-community/parse-server/security/advisories/GHSA-6r2j-cxgf-495f )) (#10144 )

2026-03-08 17:23:47 +00:00

RestWrite.js

feat: Add Parse Server option enableSanitizedErrorResponse to remove detailed error messages from responses sent to clients (#9944 )

2025-11-28 19:48:35 +01:00

SharedRest.js

fix: Parse Server role escalation and CLP bypass via direct `_Join table write ([GHSA-5f92-jrq3-28rc](https://github.com/parse-community/parse-server/security/advisories/GHSA-5f92-jrq3-28rc )) (#10142 )

2026-03-08 16:26:52 +00:00

StatusHandler.js

perf: Remove saving Parse Cloud Job request parameters in internal collection _JobStatus (#8343 )

2025-05-14 21:24:56 +02:00

TestUtils.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

triggers.js

fix: Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution ([GHSA-5j86-7r7m-p8h6](https://github.com/parse-community/parse-server/security/advisories/GHSA-5j86-7r7m-p8h6 )) (#10124 )

2026-03-07 17:38:28 +00:00

Utils.js

fix: Denylist requestKeywordDenylist keyword scan bypass through nested object placement ([GHSA-q342-9w2p-57fp](https://github.com/parse-community/parse-server/security/advisories/GHSA-q342-9w2p-57fp )) (#10122 )

2026-03-07 16:40:49 +00:00