CVE-2021-39187: parse-server - Parse Server crashes with query parameter
Summary
CVE-2021-39187: Parse Server crashes with query parameter. Affects parse-server versions < 4.10.3. Fixed in 4.10.3. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2021-39187 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that provides a scalable and easy-to-use platform for building mobile and web applications. It utilizes the MongoDB Node.js driver to interact with MongoDB databases. The vulnerability in question arises when a query request contains an invalid value for the explain option. This triggers a bug in the MongoDB Node.js driver, resulting in an uncaught exception that crashes Parse Server.
Vulnerability Detail
The vulnerability in Parse Server allows an attacker to crash the server by sending a query request with an invalid value for the explain option. This issue stems from a bug in the MongoDB Node.js driver, which throws an exception that Parse Server cannot handle. The impact of this vulnerability is a denial-of-service (DoS) condition, as the server becomes unresponsive and stops serving requests. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.10.3
This is the first release that contains the fix.
npm install parse-server@4.10.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, if upgrading to the latest version is not immediately feasible, developers can manually handle the exception in their Parse Server implementation. By catching the exception thrown by the MongoDB Node.js driver, developers can prevent the server from crashing and implement custom error handling logic. Here is an example of how to handle the exception:
try {
// Code that triggers the vulnerable query request
} catch (error) {
// Custom error handling logic
}
Conclusion
In conclusion, the vulnerability in Parse Server allows an attacker to crash the server by sending a query request with an invalid value for the explain option. This vulnerability can be mitigated by upgrading to Parse Server version 4.10.3 or later, which includes a patch to handle the exception thrown by the MongoDB Node.js driver. Alternatively, developers can implement custom error handling logic to prevent crashes until the upgrade is performed. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
Parse Server is an open-source backend framework that provides a scalable and easy-to-use platform for building mobile and web applications. It allows developers to focus on the frontend development by handling the backend infrastructure, including data storage, user authentication, and push notifications.
The vulnerability allows an attacker to crash the Parse Server by sending a query request with an invalid value for the explain option. This results in a denial-of-service (DoS) condition, rendering the server unresponsive and unable to serve requests.
To fix this vulnerability, it is recommended to upgrade to Parse Server version 4.10.3 or later. This version includes a patch that addresses the issue and prevents the server from crashing when encountering query requests with invalid explain values.
Yes, if upgrading to the latest version is not immediately feasible, developers can manually handle the exception thrown by the MongoDB Node.js driver in their Parse Server implementation. By catching the exception and implementing custom error handling logic, the server can be protected from crashes caused by the vulnerability.
The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5. It can lead to a denial-of-service (DoS) condition, impacting the availability of the Parse Server and potentially disrupting the functionality of dependent applications.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.