parse-community-parse-server

Adapters

fix: MFA recovery code single-use bypass via concurrent requests ([GHSA-2299-ghjr-6vjp](https://github.com/parse-community/parse-server/security/advisories/GHSA-2299-ghjr-6vjp )) (#10276 )

2026-03-22 01:59:30 +00:00

cli

refactor: Add lint rules for no unused vars and unused import (#9940 )

2025-11-22 22:12:34 +01:00

cloud-code

feat: Add beforePasswordResetRequest hook (#9906 )

2025-11-19 14:57:28 +01:00

Controllers

fix: Stored XSS via trailing-dot filename bypassing file upload extension blocklist ([GHSA-7wqv-xjf3-x35v](https://github.com/parse-community/parse-server/security/advisories/GHSA-7wqv-xjf3-x35v )) (#10490 )

2026-06-01 23:36:40 +02:00

Deprecator

fix: Auth provider validation bypass on login via partial authData ([GHSA-pfj7-wv7c-22pr](https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr )) (#10247 )

2026-03-19 18:46:35 +00:00

GraphQL

fix: GraphQL "Did you mean" validation suggestions disclose schema to unauthenticated callers ([GHSA-8cph-rgr4-g5vj](https://github.com/parse-community/parse-server/security/advisories/GHSA-8cph-rgr4-g5vj )) (#10468 )

2026-05-18 18:56:10 +02:00

LiveQuery

fix: LiveQuery protected-field guard bypass via array-like logical operator value ([GHSA-mmg8-87c5-jrc2](https://github.com/parse-community/parse-server/security/advisories/GHSA-mmg8-87c5-jrc2 )) (#10351 )

2026-03-29 19:37:12 +01:00

Options

fix: Auth provider validation bypass on login via partial authData ([GHSA-pfj7-wv7c-22pr](https://github.com/parse-community/parse-server/security/advisories/GHSA-pfj7-wv7c-22pr )) (#10247 )

2026-03-19 18:46:35 +00:00

Push

fix: Schema poisoning via prototype pollution in deep copy ([GHSA-9ccr-fpp6-78qf](https://github.com/parse-community/parse-server/security/advisories/GHSA-9ccr-fpp6-78qf )) (#10201 )

2026-03-14 16:01:25 +01:00

Routers

fix: Stored XSS via trailing-dot filename bypassing file upload extension blocklist ([GHSA-7wqv-xjf3-x35v](https://github.com/parse-community/parse-server/security/advisories/GHSA-7wqv-xjf3-x35v )) (#10490 )

2026-06-01 23:36:40 +02:00

SchemaMigrations

feat: Add option keepUnknownIndexes to retain indexes which are not specified in schema (#9857 )

2025-10-03 14:35:34 +02:00

Security

fix: Server crash via deeply nested query condition operators ([GHSA-9xp9-j92r-p88v](https://github.com/parse-community/parse-server/security/advisories/GHSA-9xp9-j92r-p88v )) (#10203 )

2026-03-15 02:54:44 +00:00

vendor

refactor: Upgrade to eslint 9.19.0 (#9580 )

2025-02-01 15:32:43 +01:00

AccountLockout.js

refactor: replace hardcoded error codes with references (#7546 )

2021-10-18 20:19:47 +02:00

Auth.js

fix: Denial of service via unindexed database query for unconfigured auth providers ([GHSA-g4cf-xj29-wqqr](https://github.com/parse-community/parse-server/security/advisories/GHSA-g4cf-xj29-wqqr )) (#10271 )

2026-03-21 15:49:24 +00:00

AuthDataLock.js

fix: MFA SMS one-time password accepted twice under concurrent login ([GHSA-jpq4-7fmq-q5fj](https://github.com/parse-community/parse-server/security/advisories/GHSA-jpq4-7fmq-q5fj )) (#10449 )

2026-04-26 03:12:03 +01:00

batch.js

fix: Rate limit bypass via batch request endpoint ([GHSA-775h-3xrc-c228](https://github.com/parse-community/parse-server/security/advisories/GHSA-775h-3xrc-c228 )) (#10148 )

2026-03-08 20:30:42 +00:00

cache.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

Config.js

fix: User enumeration via email verification endpoint ([GHSA-w54v-hf9p-8856](https://github.com/parse-community/parse-server/security/advisories/GHSA-w54v-hf9p-8856 )) (#10173 )

2026-03-10 13:59:30 +00:00

cryptoUtils.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

defaults.js

fix: Concurrent signup with same authentication creates duplicate users (#10150 )

2026-03-09 02:05:49 +00:00

deprecated.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

Error.js

fix: Malformed $regex query leaks database error details in API response (GHSA-9cp7-3q5w-j92g) (#10102 )

2026-03-05 20:45:39 +00:00

index.ts

feat: Add TypeScript definitions (#9693 )

2025-04-15 12:59:58 +01:00

KeyPromiseQueue.js

Add KeyPromiseQueue to Push and Job StatusHandlers (#7267 )

2021-03-15 18:51:46 -05:00

logger.ts

feat: Add TypeScript support (#9550 )

2025-01-30 01:45:35 +01:00

middlewares.js

fix: Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm )) (#10464 )

2026-05-17 15:11:27 +01:00

Page.js

Add page localization (#7128 )

2021-02-09 14:03:57 +01:00

ParseMessageQueue.js

fix(prettier): Properly handle lint-stage files (#6970 )

2020-10-25 15:06:58 -05:00

ParseServer.ts

fix: Regular Expression Denial of Service (ReDoS) via $regex query in LiveQuery ([GHSA-mf3j-86qx-cq5j](https://github.com/parse-community/parse-server/security/advisories/GHSA-mf3j-86qx-cq5j )) (#10120 )

2026-03-07 02:14:34 +00:00

ParseServerRESTController.js

feat: Upgrade Parse JS SDK from 6.0.0 to 6.1.0 (#9686 )

2025-04-02 00:09:53 +01:00

password.js

fix: Login timing side-channel reveals user existence ([GHSA-mmpq-5hcv-hf2v](https://github.com/parse-community/parse-server/security/advisories/GHSA-mmpq-5hcv-hf2v )) (#10399 )

2026-04-05 17:58:38 +01:00

PromiseRouter.js

feat: Upgrade to express 5.0.1 (#9530 )

2025-03-03 22:11:42 +01:00

request.js

refactor: Add lint rules for no unused vars and unused import (#9940 )

2025-11-22 22:12:34 +01:00

requiredParameter.js

Use Prettier JS (#5017 )

2018-09-01 13:58:06 -04:00

rest.js

fix: Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm )) (#10464 )

2026-05-17 15:11:27 +01:00

RestQuery.js

fix: Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm )) (#10464 )

2026-05-17 15:11:27 +01:00

RestWrite.js

fix: Pre-authentication denial of service via client version header regex backtracking ([GHSA-38m6-82c8-4xfm](https://github.com/parse-community/parse-server/security/advisories/GHSA-38m6-82c8-4xfm )) (#10464 )

2026-05-17 15:11:27 +01:00

SharedRest.js

fix: Classes _GraphQLConfig and _Audience master key bypass via generic class routes ([GHSA-7xg7-rqf6-pw6c](https://github.com/parse-community/parse-server/security/advisories/GHSA-7xg7-rqf6-pw6c )) (#10152 )

2026-03-09 03:41:25 +00:00

StatusHandler.js

perf: Remove saving Parse Cloud Job request parameters in internal collection _JobStatus (#8343 )

2025-05-14 21:24:56 +02:00

TestUtils.js

fix: Server internal error details leaking in error messages returned to clients (#9937 )

2025-11-23 13:51:42 +01:00

triggers.js

fix: Cloud function validator bypass via prototype chain traversal ([GHSA-vpj2-qq7w-5qq6](https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6 )) (#10343 )

2026-03-28 20:04:08 +00:00

Utils.js

fix: Stored XSS via trailing-dot filename bypassing file upload extension blocklist ([GHSA-7wqv-xjf3-x35v](https://github.com/parse-community/parse-server/security/advisories/GHSA-7wqv-xjf3-x35v )) (#10490 )

2026-06-01 23:36:40 +02:00