Invalid push request payload crashes Parse Server

ALTO 7.5CVE-2023-32688 · GHSA-mxhg-rvwx-x993 · Published 27/05/2023 · updated 17/06/2026

Em resumo

CVE-2023-32688 é uma vulnerabilidade ALTO (CVSS 7.5) que afeta parse server push adapter (parseplatform), parse-server-push-adapter.
Chance de exploração nos próximos 30 dias (EPSS): 0.90%, maior que 59.7% das vulnerabilidades.
Correção: atualize para 4.1.3 ou posterior.

Package	Affected versions	Patched versions
parse server push adapter parseplatform	`< 4.1.3`	`4.1.3`
parse-server-push-adapter npm	`< 4.1.3`	`4.1.3`

Description

Impact

The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload.

Patches

Invalid push notification payload is caught and an logged.

Workarounds

n/a

References

NVD description

parse-server-push-adapter is the official Push Notification adapter for Parse Server. The Parse Server Push Adapter can crash Parse Server due to an invalid push notification payload. This issue has been patched in version 4.1.3.

References

parse-community/parse-server-push-adapter security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2023-32688 · ADVISORY
parse-community/parse-server-push-adapter#217 · WEB
parse-community/parse-server-push-adapter commit 598cb84 · WEB
parse-community/parse-server-push-adapter · PACKAGE
parse-community/parse-server-push-adapter release 4.1.3 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free