Incorrect version tags linked to external repository in parse-server
Summary
GHSA-593v-wcqx-hq2w: Incorrect version tags linked to external repository. Affects parse-server across 2 version ranges.
>= 4.0.0, < 4.5.2
>= 4.6.0, < 4.10.0
Fixed in 4.5.2 or 4.10.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that allows developers to build scalable and secure applications. It provides a set of APIs and tools for managing data, user authentication, push notifications, and more. The vulnerability in parse-server arises from a security incident where incorrect version tags were pushed to the repository. These version tags were linked to a personal fork of a contributor who had write access to the repository. Although no releases were published with these incorrect versions, it was possible to define a Parse Server dependency that pointed to these version tags. This could lead to unexpected behavior and potential security vulnerabilities.
Vulnerability Detail
The incorrect version tags in parse-server pose several risks. Firstly, the code linked to these tags has not been reviewed or approved by Parse Platform, raising concerns about the presence of malicious code or security vulnerabilities. Additionally, functionality may not work as expected when using these incorrect versions. The vulnerability allows an attacker to define a dependency on the incorrect version tags, potentially exposing the application to security risks. It is important to note that no concerns related to privacy, legality, or proprietary code have been reported. However, the introduction of security vulnerabilities cannot be ruled out.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 4.0.0, < 4.5.24.5.2npm install parse-server@4.5.2 -
>= 4.6.0, < 4.10.04.10.0npm install parse-server@4.10.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to version 4.10.0 is not immediately feasible, a workaround is to downgrade to version 4.5.2 of parse-server. This version is not affected by the vulnerability and provides a temporary solution until the upgrade can be performed. To downgrade, update the dependency in the package.json file to specify the desired version:
"parse-server": "4.5.2"
Conclusion
The vulnerability in parse-server, caused by the introduction of incorrect version tags, can lead to unexpected behavior and potential security risks. It is crucial to upgrade to version 4.10.0 or downgrade to version 4.5.2 to mitigate these risks. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
Parse Server is an open-source backend framework that allows developers to build scalable and secure applications. It provides a set of APIs and tools for managing data, user authentication, push notifications, and more.
The incorrect version tags were pushed to the Parse Server repository as a result of a security incident. A contributor with write access to the repository linked these tags to their personal fork, bypassing the review and approval process of Parse Platform.
The vulnerability introduces the possibility of using incorrect version tags that have not been reviewed or approved. This raises concerns about the presence of malicious code or security vulnerabilities. Additionally, functionality may not work as expected when using these incorrect versions.
No privacy, security, or legality concerns (e.g., proprietary code) have been reported. The vulnerability is primarily focused on the introduction of security vulnerabilities and the potential presence of unreviewed code.
The recommended mitigation is to upgrade to version 4.10.0 of parse-server. This version contains the necessary fixes and removes the incorrect version tags. Upgrading will help ensure the security and stability of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
