Sign in
Deutsch English Español Polski
Medium

parse-server: Server option routeAllowList is bypassable through batch sub-requests

  • Disclosed: 19.06.2026
  • Updated: 11.10.2026 10:22

Impact

The routeAllowList server option restricts external client access to a configured list of REST API routes. The check is only enforced as Express middleware against the outer HTTP request URL, so the /batch handler dispatches each sub-request to the internal router without re-running the allow-list check. An external caller whose outer route matches batch can issue batch sub-requests to any REST API route that the operator omitted from the allow-list.

Authentication, ACL, CLP, and other inner-route authorization controls still apply — only the operator-configured route firewall is bypassed.

Patches

routeAllowList is now re-enforced for each batch sub-request inside the batch handler before dispatch, mirroring the existing per-sub-request rate-limit enforcement pattern. The path-normalization and regex-match logic was extracted into a shared helper used by both the outer middleware and the batch handler. Master and maintenance keys bypass the per-sub-request check on the same terms as the outer middleware.

Workarounds

Operators who use routeAllowList and have allowlisted batch can mitigate without upgrading by explicitly including every inner route they intend to allow via batch in the allow-list (for example, routeAllowList: ['batch', 'classes/Public.*', 'functions/allowedFunction']). This approach makes those inner routes reachable as direct REST requests as well, so it is broader than the post-patch behavior, but it eliminates the bypass.

Operators who do not configure routeAllowList are not affected. Parse Server v8 LTS is not affected because routeAllowList was introduced in v9.8.0.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package parse-server >= 9.8.0, < 9.9.1-alpha.3 9.9.1-alpha.3

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weakness (CWE)
CWE-863
Platform
npm
Package
parse-server
Disclosed
19.06.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-p84r-h6rx-f2xr - CC BY 4.0

Vulnerability history: parse-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (116) in the archive
Total entries
116
First → latest
06.2019 06.2026
Without a fix
0
Exploited in attacks
0

Severity breakdown

  • Critical 17
  • High 49
  • Medium 40
  • Low 10

Disclosures per year

Severity:
  1. parse-server: Server option routeAllowList is bypassable through batch sub-requests this entry
    Medium CVE-2026-50008 >= 9.8.0, < 9.9.1-alpha.3 9.9.1-alpha.3
  2. parse-server: Denial of service via exponential-time processing of deeply nested query operators
    High CVE-2026-57480 >= 9.0.0, < 9.9.1-alpha.12, < 8.6.82 9.9.1-alpha.12, 8.6.82
  3. Parse Server: Pre-authentication denial of service via client version header regex backtracking
    High CVE-2026-47138 >= 9.0.0, < 9.9.1-alpha.1, < 8.6.77 9.9.1-alpha.1, 8.6.77
  4. Parser Server's streaming file download bypasses afterFind file trigger authorization
    High CVE-2026-34784 >= 9.0.0, < 9.7.1-alpha.1, < 8.6.71 9.7.1-alpha.1, 8.6.71
  5. parse-server has GraphQL complexity validator exponential fragment traversal DoS
    High CVE-2026-34573 >= 9.0.0, < 9.7.0-alpha.12, < 8.6.68 9.7.0-alpha.12, 8.6.68
  6. parse-server has cloud function validator bypass via prototype chain traversal
    Critical CVE-2026-34532 >= 9.0.0, < 9.7.0-alpha.11, < 8.6.67 9.7.0-alpha.11, 8.6.67
  7. LiveQuery protected field leak via shared mutable state across concurrent subscribers
    High CVE-2026-34363 >= 9.0.0, < 9.7.0-alpha.9, < 8.6.65 9.7.0-alpha.9, 8.6.65
  8. Parse Server exposes auth data via verify password endpoint
    High CVE-2026-34215 >= 9.0.0, < 9.7.0-alpha.7, < 8.6.63 9.7.0-alpha.7, 8.6.63
  9. Parse Server exposes auth data via /users/me endpoint
    High CVE-2026-33627 >= 9.0.0, < 9.6.0-alpha.55, < 8.6.61 9.6.0-alpha.55, 8.6.61
  10. Parse Server has SQL Injection through aggregate and distinct field names in PostgreSQL adapter
    High CVE-2026-33539 >= 9.0.0, < 9.6.0-alpha.53, < 8.6.59 9.6.0-alpha.53, 8.6.59
  11. Parse Server: Denial of Service via unindexed database query for unconfigured auth providers
    High CVE-2026-33538 >= 9.0.0, < 9.6.0-alpha.52, < 8.6.58 9.6.0-alpha.52, 8.6.58
  12. Parse Server LiveQuery subscription query depth bypass
    High · 7.5 CVE-2026-33508 >= 9.0.0, < 9.6.0-alpha.45, < 8.6.56 9.6.0-alpha.45, 8.6.56
  13. Parse Server has a query condition depth bypass via pre-validation transform pipeline
    High · 7.5 CVE-2026-33498 >= 9.0.0, < 9.6.0-alpha.44, < 8.6.55 9.6.0-alpha.44, 8.6.55
  14. Parse Server's LiveQuery bypasses CLP pointer permission enforcement
    High · 6.5 CVE-2026-33421 >= 9.0.0, < 9.6.0-alpha.42, < 8.6.53 9.6.0-alpha.42, 8.6.53
  15. Parse Server has an auth provider validation bypass on login via partial authData
    High · 9.1 CVE-2026-33409 >= 9.0.0, < 9.6.0-alpha.41, < 8.6.52 9.6.0-alpha.41, 8.6.52
  16. Parse Server leaks protected fields via LiveQuery afterEvent trigger
    High CVE-2026-33163 >= 9.0.0, < 9.6.0-alpha.35, < 8.6.50 9.6.0-alpha.35, 8.6.50
  17. Parse Server's Cloud function dispatch crashes server via prototype chain traversal
    High CVE-2026-32886 >= 9.0.0, < 9.6.0-alpha.24, < 8.6.47 9.6.0-alpha.24, 8.6.47
  18. Parse Server crash via deeply nested query condition operators
    High CVE-2026-32944 >= 9.0.0, < 9.6.0-alpha.21, < 8.6.45 9.6.0-alpha.21, 8.6.45
  19. Parse Server has a stored XSS filter bypass via Content-Type MIME parameter and missing XML extension blocklist entries
    High CVE-2026-32728 >= 9.0.0, < 9.6.0-alpha.15, < 8.6.41 9.6.0-alpha.15, 8.6.41
  20. Parse Server: Account takeover via operator injection in authentication data identifier
    Critical CVE-2026-32248 >= 9.0.0, < 9.6.0-alpha.12, < 8.6.38 9.6.0-alpha.12, 8.6.38
  21. Parse Server's OAuth2 adapter shares mutable state across providers via singleton instance
    Critical CVE-2026-32242 >= 9.0.0, < 9.6.0-alpha.11, < 8.6.37 9.6.0-alpha.11, 8.6.37
  22. Parse Server's MFA recovery codes not consumed after use
    High CVE-2026-31875 >= 9.0.0-alpha.1, < 9.6.0-alpha.7, < 8.6.33 9.6.0-alpha.7, 8.6.33
  23. Parse Server has a protected fields bypass via dot-notation in query and sort
    High CVE-2026-31872 >= 9.0.0-alpha.1, < 9.6.0-alpha.6, < 8.6.32 9.6.0-alpha.6, 8.6.32
  24. Parse Server vulnerable to SQL Injection via dot-notation sub-key name in `Increment` operation on PostgreSQL
    Critical CVE-2026-31871 >= 9.0.0-alpha.1, < 9.6.0-alpha.5, < 8.6.31 9.6.0-alpha.5, 8.6.31
  25. Parse Server vulnerable to SQL injection via `Increment` operation on nested object field in PostgreSQL
    Critical CVE-2026-31856 >= 9.0.0-alpha.1, < 9.6.0-alpha.3, < 8.6.29 9.6.0-alpha.3, 8.6.29
  26. Parse Server: Classes `_GraphQLConfig` and `_Audience` master key bypass via generic class routes
    High CVE-2026-31800 >= 9.0.0-alpha.1, < 9.5.2-alpha.12, < 8.6.25 9.5.2-alpha.12, 8.6.25
  27. Parse Server OAuth2 authentication adapter account takeover via identity spoofing
    High CVE-2026-30967 >= 9.0.0-alpha.1, < 9.5.2-alpha.9, < 8.6.22 9.5.2-alpha.9, 8.6.22
  28. Parse Server has role escalation and CLP bypass via direct `_Join` table write
    Critical · 10.0 CVE-2026-30966 >= 9.0.0-alpha.1, < 9.5.2-alpha.7, < 8.6.20 9.5.2-alpha.7, 8.6.20
  29. Parse Server vulnerable to session token exfiltration via `redirectClassNameForKey` query parameter
    Critical CVE-2026-30965 >= 9.0.0-alpha.1, < 9.5.2-alpha.8, < 8.6.21 9.5.2-alpha.8, 8.6.21
  30. Parse Server has a protected fields bypass via logical query operators
    High CVE-2026-30962 >= 9.0.0, < 9.5.2-alpha.6, < 8.6.19 9.5.2-alpha.6, 8.6.19
  31. Parse Server missing audience validation in Keycloak authentication adapter
    High CVE-2026-30949 >= 9.0.0, < 9.5.2-alpha.5, < 8.6.18 9.5.2-alpha.5, 8.6.18
  32. Parse Server vulnerable to stored cross-site scripting (XSS) via SVG file upload
    High CVE-2026-30948 >= 9.0.0, < 9.5.2-alpha.4, < 8.6.17 9.5.2-alpha.4, 8.6.17
  33. Parse Server has a bypass of class-level permissions in LiveQuery
    High CVE-2026-30947 >= 9.0.0, < 9.5.2-alpha.3, < 8.6.16 9.5.2-alpha.3, 8.6.16
  34. Parse Server affected by denial-of-service via unbounded query complexity in REST and GraphQL API
    High CVE-2026-30946 < 8.6.15, >= 9.0.0, < 9.5.2-alpha.2 8.6.15, 9.5.2-alpha.2
  35. Parse Server has a NoSQL injection via token type in password reset and email verification endpoints
    High CVE-2026-30941 >= 9.0.0, < 9.5.2-alpha.1, < 8.6.14 9.5.2-alpha.1, 8.6.14
  36. Parse Server: SQL injection via dot-notation field name in PostgreSQL
    Critical CVE-2026-31840 >= 9.0.0, < 9.6.0-alpha.2, < 8.6.28 9.6.0-alpha.2, 8.6.28
  37. Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution
    High CVE-2026-30939 < 8.6.13, >= 9.0.0-alpha.1, < 9.5.1-alpha.2 8.6.13, 9.5.1-alpha.2
  38. Parse Server has Regular Expression Denial of Service (ReDoS) via `$regex` query in LiveQuery
    High CVE-2026-30925 >= 9.0.0-alpha.1, < 9.5.0-alpha.14, < 8.6.11 9.5.0-alpha.14, 8.6.11
  39. Parse Server: JWT audience validation bypass in Google, Apple, and Facebook authentication adapters
    Critical CVE-2026-30863 >= 9.0.0-alpha.1, < 9.5.0-alpha.11, < 8.6.10 9.5.0-alpha.11, 8.6.10
  40. parse-server's endpoint `/loginAs` allows `readOnlyMasterKey` to gain full read and write access as any user
    High CVE-2026-30229 < 8.6.6, >= 9.0.0, < 9.5.0-alpha.4 8.6.6, 9.5.0-alpha.4
  41. Parse Server's Cloud Hooks and Cloud Jobs bypass `readOnlyMasterKey` write restriction
    High CVE-2026-29182 >= 9.0.0, < 9.4.1-alpha.3, < 8.6.4 9.4.1-alpha.3, 8.6.4
  42. Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter
    Critical CVE-2026-27804 >= 9.0.0, < 9.3.1-alpha.4, < 8.6.3 9.3.1-alpha.4, 8.6.3
  43. Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
    High CVE-2025-68150 >= 9.0.0, < 9.1.1-alpha.1, < 8.6.2 9.1.1-alpha.1, 8.6.2
  44. Parse Server Vulnerable to Server-Side Request Forgery (SSRF) in File Upload via URI Format
    High · 7.5 CVE-2025-64430 >= 4.2.0, < 7.5.4, >= 8.0.0, < 8.4.0-alpha.2 7.5.4, 8.4.0-alpha.2
  45. Parse Server's custom object ID allows to acquire role privileges
    High · 8.1 CVE-2024-47183 < 6.5.9, >= 7.0.0, < 7.3.0 6.5.9, 7.3.0
  46. ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability
    Critical · 9.8 CVE-2024-39309 < 6.5.7, >= 7.0.0, < 7.1.0 6.5.7, 7.1.0
  47. Server crashes on invalid Cloud Function or Cloud Job name
    Critical · 9.0 CVE-2024-29027 < 6.5.5, >= 7.0.0-alpha.1, < 7.0.0-alpha.29 6.5.5, 7.0.0-alpha.29
  48. ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
    Critical · 10.0 CVE-2024-27298 < 6.5.0, >= 7.0.0-alpha.1, < 7.0.0-alpha.20 6.5.0, 7.0.0-alpha.20
  49. Parse Server may crash when uploading file without extension
    High · 7.5 CVE-2023-46119 >= 1.0.0, < 5.5.6, >= 6.0.0, < 6.3.1 5.5.6, 6.3.1
  50. Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer
    High · 7.5 CVE-2023-41058 >= 1.0.0, < 5.5.5, >= 6.0.0, < 6.2.2 5.5.5, 6.2.2
  51. Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
    Critical · 9.8 CVE-2023-36475 < 5.5.2, >= 6.0.0, < 6.2.1 5.5.2, 6.2.1
  52. Parse Server option `masterKeyIps` vulnerability to IP spoofing
    High · 8.7 CVE-2023-22474 < 5.4.1 5.4.1
  53. Parse Server is vulnerable to Prototype Pollution via Cloud Code Webhooks
    High · 7.2 CVE-2022-41879 < 4.10.20, >= 5.0.0, < 5.3.3 4.10.20, 5.3.3
  54. Parse Server vulnerable to Prototype Pollution via Cloud Code Webhooks or Cloud Code Triggers
    High · 7.2 CVE-2022-41878 < 4.10.19, >= 5.0.0, < 5.3.2 4.10.19, 5.3.2
  55. Remote code execution via MongoDB BSON parser through prototype pollution
    Critical · 9.8 CVE-2022-39396 < 4.10.18, >= 5.0.0, < 5.3.1 4.10.18, 5.3.1
  56. parse-server crashes when receiving file download request with invalid byte range
    High · 7.5 CVE-2022-39313 < 4.10.17, >= 5.0.0, < 5.2.8 4.10.17, 5.2.8
  57. Parse Server vulnerable to brute force guessing of user sensitive data via search patterns
    High · 8.6 CVE-2022-36079 < 4.10.14, >= 5.0.0, < 5.2.5 4.10.14, 5.2.5
  58. Protected fields exposed via LiveQuery
    High · 8.2 CVE-2022-31112 < 4.10.13, >= 5.0.0, < 5.2.4 4.10.13, 5.2.4
  59. Invalid file request can crash server
    High · 7.5 CVE-2022-31089 < 4.10.12, >= 5.0.0, < 5.2.3 4.10.12, 5.2.3
  60. Authentication bypass vulnerability in Apple Game Center auth adapter
    High · 8.6 CVE-2022-31083 < 4.10.11, >= 5.0.0, < 5.2.2 4.10.11, 5.2.2
  61. Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter
    High · 7.5 CVE-2022-24901 < 4.10.10, >= 5.0.0, < 5.2.1 4.10.10, 5.2.1
  62. Command injection in Parse Server through prototype pollution
    Critical · 10.0 CVE-2022-24760 < 4.10.7 4.10.7
  63. LiveQuery publishes user session tokens in parse-server
    High · 7.5 CVE-2021-41109 < 4.10.4 4.10.4
  64. Incorrect version tags linked to external repository
    Critical CVE-2021-47986 >= 4.0.0, < 4.5.2, >= 4.6.0, < 4.10.0 4.5.2, 4.10.0
  65. Parse Server crashes with query parameter
    High · 7.5 CVE-2021-39187 < 4.10.3 4.10.3
  66. Information disclosure in parse-server
    High · 7.7 CVE-2020-5251 < 4.1.0 4.1.0
  67. Parse Server before v3.4.1 vulnerable to Denial of Service
    High · 7.5 CVE-2019-1020012 < 3.4.1 3.4.1

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.