Invalid push request payload crashes Parse Server

ALTO 7.5CVE-2023-32688 · GHSA-mxhg-rvwx-x993 · Published 27/05/2023 · updated 17/06/2026

In breve

CVE-2023-32688 è una vulnerabilità ALTO (CVSS 7.5) che riguarda parse server push adapter (parseplatform), parse-server-push-adapter.
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 0.90%, superiore al 59.7% delle vulnerabilità.
Correzione: aggiornare a 4.1.3 o successiva.

Package	Affected versions	Patched versions
parse server push adapter parseplatform	`< 4.1.3`	`4.1.3`
parse-server-push-adapter npm	`< 4.1.3`	`4.1.3`

Description

Impact

The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.

Patches

Invalid push notification payload is caught and an logged.

Workarounds

n/a

References

NVD description

parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload. This issue has been patched in version 4.1.3.

References

parse-community/parse-server-push-adapter security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-32688 · ADVISORY
parse-community/parse-server-push-adapter#217 · WEB
parse-community/parse-server-push-adapter commit 598cb84 · WEB
parse-community/parse-server-push-adapter · PACKAGE
parse-community/parse-server-push-adapter release 4.1.3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free