CVE-2020-5251: Information disclosure in parse-server
Summary
CVE-2020-5251: Information disclosure in parse-server. Affects parse-server versions < 4.1.0. Fixed in 4.1.0. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2020-5251 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
parse-server is an open-source backend framework that allows developers to build scalable and customizable applications. It provides a RESTful API for managing data and user authentication. This vulnerability affects parse-server versions 0.0.0 to 4.0.0.
Vulnerability Detail
The vulnerability allows an attacker to retrieve sensitive information and perform unauthorized actions. By using regex in NoSQL queries, an attacker can fetch all users' objects and find valid accounts without user interaction. This can lead to information disclosure and potential account compromise. Additionally, the vulnerability affects the verification of email addresses and password reset functionality, allowing an attacker to verify or reset accounts by manipulating the token parameter with regex.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.0
This is the first release that contains the fix.
npm install parse-server@4.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement additional server-side validation and authorization checks to restrict access to sensitive user data. It is also recommended to disable the affected email verification and password reset endpoints until the vulnerability is fixed.
Conclusion
The information disclosure vulnerability in parse-server can lead to unauthorized access to user data and potential account compromise. It is crucial to upgrade to the latest version and review code for any regex injection vulnerabilities. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for parse-server →
FAQ
parse-server is an open-source backend framework for building scalable applications.
This vulnerability allows attackers to retrieve sensitive user information and perform unauthorized actions.
Versions 0.0.0 to 4.0.0 of parse-server are affected by this vulnerability.
To fix this vulnerability, upgrade parse-server to version 4.1.0 or higher and review code for regex injection vulnerabilities.
As a temporary workaround, implement additional server-side validation and authorization checks, and disable affected endpoints.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
