Sign in
Deutsch English Español Polski
Medium

Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement

  • Disclosed: 10.03.2026
  • Updated: 11.10.2026 10:22

Impact

The requestKeywordDenylist security control can be bypassed by placing any nested object or array before a prohibited keyword in the request payload. This is caused by a logic bug that stops scanning sibling keys after encountering the first nested value. Any custom requestKeywordDenylist entries configured by the developer are equally by-passable using the same technique.

All Parse Server deployments are affected. The requestKeywordDenylist is enabled by default.

Patches

The fix replaces the recursive object scanner with an iterative stack-based traversal that processes all nested values without prematurely exiting the scan loop. This also eliminates a potential stack overflow on deeply nested payloads.

Workarounds

Use a Cloud Code beforeSave trigger to validate incoming data for prohibited keywords across all classes.

References

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package parse-server < 8.6.12, >= 9.0.0-alpha.1, < 9.5.1-alpha.1 8.6.12, 9.5.1-alpha.1

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-693
Platform
npm
Package
parse-server
Disclosed
10.03.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-q342-9w2p-57fp - CC BY 4.0

Vulnerability history: parse-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (116) in the archive
Total entries
116
First → latest
06.2019 06.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 17
  • High 49
  • Medium 40
  • Low 10

Disclosures per year

Severity:
  1. parse-server: Denial of service via exponential-time processing of deeply nested query operators
    High CVE-2026-57480 >= 9.0.0, < 9.9.1-alpha.12, < 8.6.82 9.9.1-alpha.12, 8.6.82
  2. Parse Server: Pre-authentication denial of service via client version header regex backtracking
    High CVE-2026-47138 >= 9.0.0, < 9.9.1-alpha.1, < 8.6.77 9.9.1-alpha.1, 8.6.77
  3. Parser Server's streaming file download bypasses afterFind file trigger authorization
    High CVE-2026-34784 >= 9.0.0, < 9.7.1-alpha.1, < 8.6.71 9.7.1-alpha.1, 8.6.71
  4. parse-server has GraphQL complexity validator exponential fragment traversal DoS
    High CVE-2026-34573 >= 9.0.0, < 9.7.0-alpha.12, < 8.6.68 9.7.0-alpha.12, 8.6.68
  5. parse-server has cloud function validator bypass via prototype chain traversal
    Critical CVE-2026-34532 >= 9.0.0, < 9.7.0-alpha.11, < 8.6.67 9.7.0-alpha.11, 8.6.67
  6. LiveQuery protected field leak via shared mutable state across concurrent subscribers
    High CVE-2026-34363 >= 9.0.0, < 9.7.0-alpha.9, < 8.6.65 9.7.0-alpha.9, 8.6.65
  7. Parse Server exposes auth data via verify password endpoint
    High CVE-2026-34215 >= 9.0.0, < 9.7.0-alpha.7, < 8.6.63 9.7.0-alpha.7, 8.6.63
  8. Parse Server exposes auth data via /users/me endpoint
    High CVE-2026-33627 >= 9.0.0, < 9.6.0-alpha.55, < 8.6.61 9.6.0-alpha.55, 8.6.61
  9. Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
    High CVE-2026-33539 >= 9.0.0, < 9.6.0-alpha.53, < 8.6.59 9.6.0-alpha.53, 8.6.59
  10. Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
    High CVE-2026-33538 >= 9.0.0, < 9.6.0-alpha.52, < 8.6.58 9.6.0-alpha.52, 8.6.58
  11. Parse Server LiveQuery subscription query depth bypass
    High · 7.5 CVE-2026-33508 >= 9.0.0, < 9.6.0-alpha.45, < 8.6.56 9.6.0-alpha.45, 8.6.56
  12. Parse Server has a query condition depth bypass via pre-validation transform pipeline
    High · 7.5 CVE-2026-33498 >= 9.0.0, < 9.6.0-alpha.44, < 8.6.55 9.6.0-alpha.44, 8.6.55
  13. Parse Server's LiveQuery bypasses CLP pointer permission enforcement
    High · 6.5 CVE-2026-33421 >= 9.0.0, < 9.6.0-alpha.42, < 8.6.53 9.6.0-alpha.42, 8.6.53
  14. Parse Server has an auth provider validation bypass on login via partial authData
    High · 9.1 CVE-2026-33409 >= 9.0.0, < 9.6.0-alpha.41, < 8.6.52 9.6.0-alpha.41, 8.6.52
  15. Parse Server leaks protected fields via LiveQuery afterEvent trigger
    High CVE-2026-33163 >= 9.0.0, < 9.6.0-alpha.35, < 8.6.50 9.6.0-alpha.35, 8.6.50
  16. Parse Server's Cloud function dispatch crashes server via prototype chain traversal
    High CVE-2026-32886 >= 9.0.0, < 9.6.0-alpha.24, < 8.6.47 9.6.0-alpha.24, 8.6.47
  17. Parse Server crash via deeply nested query condition operators
    High CVE-2026-32944 >= 9.0.0, < 9.6.0-alpha.21, < 8.6.45 9.6.0-alpha.21, 8.6.45
  18. Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
    High CVE-2026-32728 >= 9.0.0, < 9.6.0-alpha.15, < 8.6.41 9.6.0-alpha.15, 8.6.41
  19. Parse Server: Account takeover via operator injection in authentication data identifier
    Critical CVE-2026-32248 >= 9.0.0, < 9.6.0-alpha.12, < 8.6.38 9.6.0-alpha.12, 8.6.38
  20. Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
    Critical CVE-2026-32242 >= 9.0.0, < 9.6.0-alpha.11, < 8.6.37 9.6.0-alpha.11, 8.6.37
  21. Parse Server's MFA recovery codes not consumed after use
    High CVE-2026-31875 >= 9.0.0-alpha.1, < 9.6.0-alpha.7, < 8.6.33 9.6.0-alpha.7, 8.6.33
  22. Parse Server has a protected fields bypass via dot-notation in query and sort
    High CVE-2026-31872 >= 9.0.0-alpha.1, < 9.6.0-alpha.6, < 8.6.32 9.6.0-alpha.6, 8.6.32
  23. Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
    Critical CVE-2026-31871 >= 9.0.0-alpha.1, < 9.6.0-alpha.5, < 8.6.31 9.6.0-alpha.5, 8.6.31
  24. Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
    Critical CVE-2026-31856 >= 9.0.0-alpha.1, < 9.6.0-alpha.3, < 8.6.29 9.6.0-alpha.3, 8.6.29
  25. Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
    High CVE-2026-31800 >= 9.0.0-alpha.1, < 9.5.2-alpha.12, < 8.6.25 9.5.2-alpha.12, 8.6.25
  26. Parse Server OAuth2 authentication adapter account takeover via identity spoofing
    High CVE-2026-30967 >= 9.0.0-alpha.1, < 9.5.2-alpha.9, < 8.6.22 9.5.2-alpha.9, 8.6.22
  27. Parse Server has role escalation and CLP bypass via direct `_Join` table write
    Critical · 10.0 CVE-2026-30966 >= 9.0.0-alpha.1, < 9.5.2-alpha.7, < 8.6.20 9.5.2-alpha.7, 8.6.20
  28. Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
    Critical CVE-2026-30965 >= 9.0.0-alpha.1, < 9.5.2-alpha.8, < 8.6.21 9.5.2-alpha.8, 8.6.21
  29. Parse Server has a protected fields bypass via logical query operators
    High CVE-2026-30962 >= 9.0.0, < 9.5.2-alpha.6, < 8.6.19 9.5.2-alpha.6, 8.6.19
  30. Parse Server missing audience validation in Keycloak authentication adapter
    High CVE-2026-30949 >= 9.0.0, < 9.5.2-alpha.5, < 8.6.18 9.5.2-alpha.5, 8.6.18
  31. Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload
    High CVE-2026-30948 >= 9.0.0, < 9.5.2-alpha.4, < 8.6.17 9.5.2-alpha.4, 8.6.17
  32. Parse Server has a bypass of class-level permissions in LiveQuery
    High CVE-2026-30947 >= 9.0.0, < 9.5.2-alpha.3, < 8.6.16 9.5.2-alpha.3, 8.6.16
  33. Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
    High CVE-2026-30946 < 8.6.15, >= 9.0.0, < 9.5.2-alpha.2 8.6.15, 9.5.2-alpha.2
  34. Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
    High CVE-2026-30941 >= 9.0.0, < 9.5.2-alpha.1, < 8.6.14 9.5.2-alpha.1, 8.6.14
  35. Parse Server: SQL injection via dot-notation field name in PostgreSQL
    Critical CVE-2026-31840 >= 9.0.0, < 9.6.0-alpha.2, < 8.6.28 9.6.0-alpha.2, 8.6.28
  36. Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
    High CVE-2026-30939 < 8.6.13, >= 9.0.0-alpha.1, < 9.5.1-alpha.2 8.6.13, 9.5.1-alpha.2
  37. Parse Server has denylist `requestKeywordDenylist` keyword scan bypass through nested object placement this entry
    Medium CVE-2026-30938 < 8.6.12, >= 9.0.0-alpha.1, < 9.5.1-alpha.1 8.6.12, 9.5.1-alpha.1
  38. Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
    High CVE-2026-30925 >= 9.0.0-alpha.1, < 9.5.0-alpha.14, < 8.6.11 9.5.0-alpha.14, 8.6.11
  39. Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
    Critical CVE-2026-30863 >= 9.0.0-alpha.1, < 9.5.0-alpha.11, < 8.6.10 9.5.0-alpha.11, 8.6.10
  40. parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
    High CVE-2026-30229 < 8.6.6, >= 9.0.0, < 9.5.0-alpha.4 8.6.6, 9.5.0-alpha.4
Show more (20) Showing 40 of 67

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.