Skip to content

Commit dd8be53

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-5j86-7r7m-p8h6 GHSA-q342-9w2p-57fp
1 parent f7155e3 commit dd8be53

2 files changed

Lines changed: 168 additions & 0 deletions

File tree

‎advisories/github-reviewed/2026/03/GHSA-5j86-7r7m-p8h6/GHSA-5j86-7r7m-p8h6.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-5j86-7r7m-p8h6",
4+
"modified": "2026-03-10T00:57:57Z",
5+
"published": "2026-03-10T00:57:57Z",
6+
"aliases": [
7+
"CVE-2026-30939"
8+
],
9+
"summary": "Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution",
10+
"details": "### Impact\n\nAn unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the function name. The server recurses infinitely, causing a call stack size error that terminates the process.\n\nOther prototype property names bypass Cloud Function dispatch validation and return HTTP 200 responses, even though no such Cloud Functions are defined. The same applies to dot-notation traversal.\n\nAll Parse Server deployments that expose the Cloud Function endpoint are affected.\n\n### Patches\n\nThe internal handler registries for Cloud Functions, Jobs, Triggers, and Validators have been changed to prevent prototype chain properties from being resolved.\n\n### Workarounds\n\nPlace a reverse proxy or WAF in front of Parse Server and block requests to `Object.prototype` property names.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-5j86-7r7m-p8h6\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.2\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.13",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "8.6.13"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "9.0.0-alpha.1"
48+
},
49+
{
50+
"fixed": "9.5.1-alpha.2"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-5j86-7r7m-p8h6"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/parse-community/parse-server"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.13"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.2"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-1321"
78+
],
79+
"severity": "HIGH",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-03-10T00:57:57Z",
82+
"nvd_published_at": null
83+
}
84+
}

‎advisories/github-reviewed/2026/03/GHSA-q342-9w2p-57fp/GHSA-q342-9w2p-57fp.json‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-q342-9w2p-57fp",
4+
"modified": "2026-03-10T00:57:37Z",
5+
"published": "2026-03-10T00:57:37Z",
6+
"aliases": [
7+
"CVE-2026-30938"
8+
],
9+
"summary": "Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement",
10+
"details": "### Impact\n\nThe `requestKeywordDenylist` security control can be bypassed by placing any nested object or array before a prohibited keyword in the request payload. This is caused by a logic bug that stops scanning sibling keys after encountering the first nested value. Any custom `requestKeywordDenylist` entries configured by the developer are equally by-passable using the same technique.\n\nAll Parse Server deployments are affected. The `requestKeywordDenylist` is enabled by default.\n\n### Patches\n\nThe fix replaces the recursive object scanner with an iterative stack-based traversal that processes all nested values without prematurely exiting the scan loop. This also eliminates a potential stack overflow on deeply nested payloads.\n\n### Workarounds\n\nUse a Cloud Code `beforeSave` trigger to validate incoming data for prohibited keywords across all classes.\n\n### References\n\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q342-9w2p-57fp\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.1\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/releases/tag/8.6.12",
11+
"severity": [
12+
{
13+
"type": "CVSS_V4",
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "npm",
21+
"name": "parse-server"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "8.6.12"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "npm",
40+
"name": "parse-server"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "9.0.0-alpha.1"
48+
},
49+
{
50+
"fixed": "9.5.1-alpha.1"
51+
}
52+
]
53+
}
54+
]
55+
}
56+
],
57+
"references": [
58+
{
59+
"type": "WEB",
60+
"url": "https://github.com/parse-community/parse-server/security/advisories/GHSA-q342-9w2p-57fp"
61+
},
62+
{
63+
"type": "PACKAGE",
64+
"url": "https://github.com/parse-community/parse-server"
65+
},
66+
{
67+
"type": "WEB",
68+
"url": "https://github.com/parse-community/parse-server/releases/tag/8.6.12"
69+
},
70+
{
71+
"type": "WEB",
72+
"url": "https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.1"
73+
}
74+
],
75+
"database_specific": {
76+
"cwe_ids": [
77+
"CWE-693"
78+
],
79+
"severity": "MODERATE",
80+
"github_reviewed": true,
81+
"github_reviewed_at": "2026-03-10T00:57:37Z",
82+
"nvd_published_at": null
83+
}
84+
}

0 commit comments

Comments
 (0)