GHSA-xqp8-w826-hh6x

Parse Server crashes with query parameter

Source: GitHub Advisory Database (reviewed) High CVE-2021-39187

Packages

Ecosystem	Package	Affected	Fixed in
npm	parse-server	< 4.10.3	4.10.3

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. ### Patches Upgrade to Parse Server 4.10.3

References

External links from the advisory. They lead to third-party sites.

https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6x web
https://nvd.nist.gov/vuln/detail/CVE-2021-39187 advisory
https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ec web
https://github.com/parse-community/parse-server package
https://github.com/parse-community/parse-server/releases/tag/4.10.3 web
https://jira.mongodb.org/browse/NODE-3463 web