Invalid push request payload crashes Parse Server

HOCH 7.5CVE-2023-32688 · GHSA-mxhg-rvwx-x993 · Published 27/05/2023 · updated 17/06/2026

Kurz gesagt

CVE-2023-32688 ist eine Schwachstelle (HOCH (CVSS 7.5)) in parse server push adapter (parseplatform), parse-server-push-adapter.
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.90%, höher als bei 59.7% aller Schwachstellen.
Abhilfe: auf 4.1.3 oder neuer aktualisieren.

Package	Affected versions	Patched versions
parse server push adapter parseplatform	`< 4.1.3`	`4.1.3`
parse-server-push-adapter npm	`< 4.1.3`	`4.1.3`

Description

Impact

The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.

Patches

Invalid push notification payload is caught and an logged.

Workarounds

n/a

References

NVD description

parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload. This issue has been patched in version 4.1.3.

References

parse-community/parse-server-push-adapter security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-32688 · ADVISORY
parse-community/parse-server-push-adapter#217 · WEB
parse-community/parse-server-push-adapter commit 598cb84 · WEB
parse-community/parse-server-push-adapter · PACKAGE
parse-community/parse-server-push-adapter release 4.1.3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free