Invalid push request payload crashes Parse Server

HIGH 7.5CVE-2023-32688 · GHSA-mxhg-rvwx-x993 · Published 27/05/2023 · updated 17/06/2026

In short

CVE-2023-32688 is a HIGH (CVSS 7.5) vulnerability affecting parse server push adapter (parseplatform), parse-server-push-adapter.
Chance of exploitation in the next 30 days (EPSS): 0.90%, higher than 59.7% of all vulnerabilities.
Fix: update to 4.1.3 or later.

Package	Affected versions	Patched versions
parse server push adapter parseplatform	`< 4.1.3`	`4.1.3`
parse-server-push-adapter npm	`< 4.1.3`	`4.1.3`

Description

Impact

The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.

Patches

Invalid push notification payload is caught and an logged.

Workarounds

n/a

References

NVD description

parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload. This issue has been patched in version 4.1.3.

References

parse-community/parse-server-push-adapter security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-32688 · ADVISORY
parse-community/parse-server-push-adapter#217 · WEB
parse-community/parse-server-push-adapter commit 598cb84 · WEB
parse-community/parse-server-push-adapter · PACKAGE
parse-community/parse-server-push-adapter release 4.1.3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free