HIGH7.5

GHSA-xqp8-w826-hh6x

Parse Server crashes with query parameter

Quick fix

GHSA-xqp8-w826-hh6x — parse-server: upgrade to the fixed version with the command below.

npm install parse-server@4.10.3

Details

### Impact Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch.

### Patches Upgrade to Parse Server 4.10.3

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/parse-server

Introduced in: 0Fixed in: 4.10.3

Fixnpm install parse-server@4.10.3

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6x[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2021-39187[ADVISORY]
https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ec[WEB]
https://github.com/parse-community/parse-server[PACKAGE]
https://github.com/parse-community/parse-server/releases/tag/4.10.3[WEB]
https://jira.mongodb.org/browse/NODE-3463[WEB]