Parse Server File Upload Crash Vulnerability (CVE-2023-46119)
Summary
CVE-2023-46119: Parse Server may crash when uploading file without extension. Affects parse-server across 2 version ranges.
>= 1.0.0, < 5.5.6
>= 6.0.0, < 6.3.1
Fixed in 5.5.6 or 6.3.1, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2023-46119 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that allows developers to build scalable and flexible applications. It provides a set of APIs and tools for managing data, user authentication, and file storage. The vulnerability identified as CVE-2023-46119 affects Parse Server and can lead to a server crash when uploading a file without an extension.
Vulnerability Detail
The vulnerability arises from a lack of proper input validation when processing file uploads. When a file without an extension is uploaded, Parse Server fails to handle it correctly, resulting in a crash. This vulnerability can be exploited by an attacker to disrupt the server's availability and potentially cause a denial-of-service (DoS) condition. The impact of this vulnerability is considered high, with a CVSS score of 7.5.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 5.5.65.5.6npm install parse-server@5.5.6 -
>= 6.0.0, < 6.3.16.3.1npm install parse-server@6.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to apply the recommended fix by updating Parse Server to the patched versions.
Conclusion
The Parse Server File Upload Crash Vulnerability (CVE-2023-46119) can lead to a server crash when uploading files without extensions. It is crucial to update Parse Server to the patched versions (5.5.6 or later for LTS, 6.3.1 or later for main) to mitigate this vulnerability. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
Parse Server is an open-source backend framework that enables developers to build scalable and flexible applications. It provides APIs and tools for managing data, user authentication, and file storage.
The vulnerability can cause Parse Server to crash when uploading a file without an extension. This can lead to a denial-of-service (DoS) condition and disrupt the server's availability.
To fix this vulnerability, update Parse Server to version 5.5.6 or later for the LTS branch, or version 6.3.1 or later for the main branch. These versions include a permanent fix for the issue.
No, there are no known workarounds for this vulnerability. It is crucial to apply the recommended fix by updating Parse Server.
You can find more information about this vulnerability in the GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
