CVE-2022-39396: Remote code execution via MongoDB BSON parser through prototype pollution in parse-server
Summary
CVE-2022-39396: Remote code execution via MongoDB BSON parser through prototype pollution. Affects parse-server across 2 version ranges.
< 4.10.18
>= 5.0.0, < 5.3.1
Fixed in 4.10.18 or 5.3.1, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2022-39396 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
parse-server is an open-source backend framework that allows developers to build scalable and customizable applications. It provides a set of APIs and tools for managing data and user authentication. The vulnerability identified as CVE-2022-39396 affects parse-server and specifically targets the MongoDB BSON parser.
Vulnerability Detail
The vulnerability allows an attacker to exploit prototype pollution in the MongoDB BSON parser, leading to remote code execution. By injecting malicious data into the parser, an attacker can manipulate the prototype chain and execute arbitrary code on the target system. This can result in unauthorized access, data breaches, and potential system compromise.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 4.10.184.10.18npm install parse-server@4.10.18 -
>= 5.0.0, < 5.3.15.3.1npm install parse-server@5.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating parse-server is not immediately feasible, a temporary workaround is to disable remote code execution through the MongoDB BSON parser. This can be achieved by implementing appropriate security measures, such as input validation and sanitization, to prevent the injection of malicious data into the parser.
Conclusion
The vulnerability CVE-2022-39396 in parse-server's MongoDB BSON parser allows for remote code execution, potentially leading to unauthorized access, data breaches, and system compromise. It is crucial to update parse-server to the recommended versions or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
parse-server is an open-source backend framework that enables developers to build scalable and customizable applications. It provides APIs and tools for managing data and user authentication.
Prototype pollution is a vulnerability that allows an attacker to manipulate the prototype chain of an object. By injecting malicious data, an attacker can modify the behavior of the target system and potentially execute arbitrary code.
The vulnerability can lead to remote code execution, allowing an attacker to execute arbitrary code on the target system. This can result in unauthorized access, data breaches, and potential system compromise.
To fix this vulnerability, update parse-server to version 4.10.18 or later for versions 4.x.x, and to version 5.3.1 or later for versions 5.x.x. These updates include patches that prevent prototype pollution in the MongoDB database adapter.
A temporary workaround is to disable remote code execution through the MongoDB BSON parser by implementing input validation and sanitization to prevent the injection of malicious data.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
