Parse Server crashes with query parameter

高 7.5CVE-2021-39187 · BIT-parse-2021-39187 · GHSA-xqp8-w826-hh6x · 02/09/2021 公開 · 17/06/2026 更新

要点

CVE-2021-39187 は parse-server (parseplatform), parse-server に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.8%（全脆弱性の 78.7% より高い）。
対処：4.10.3 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
parse-server parseplatform	`< 4.10.3`	`4.10.3`
parse-server npm	`< 4.10.3`	`4.10.3`

概要

Impact

Parse Server crashes when if a query request contains an invalid value for the explain option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch.

Patches

Upgrade to Parse Server 4.10.3

NVD の説明

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist.