CVE-2021-39187

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to version 4.10.3, Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch. There is a patch for this issue in version 4.10.3. No workarounds aside from upgrading are known to exist.

• CWE-74
• CWE-755

• https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ecPatch, Third Party Advisory
• https://github.com/parse-community/parse-server/releases/tag/4.10.3Third Party Advisory
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6xThird Party Advisory
• https://jira.mongodb.org/browse/NODE-3463Patch, Third Party Advisory
• https://github.com/parse-community/parse-server/commit/308668c89474223e2448be92d6823b52c1c313ecPatch, Third Party Advisory
• https://github.com/parse-community/parse-server/releases/tag/4.10.3Third Party Advisory
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xqp8-w826-hh6xThird Party Advisory
• https://jira.mongodb.org/browse/NODE-3463Patch, Third Party Advisory

Published

Sep 2, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-39181OpenOlat is a web-based learning management system (LMS). Pr…8.8
• CVE-2021-39182EnroCrypt is a Python module for encryption and hashing. Pri…7.5
• CVE-2021-39183Owncast is an open source, self-hosted live video streaming …6.1
• CVE-2021-39184Electron is a framework for writing cross-platform desktop a…8.6
• CVE-2021-39185Http4s is a minimal, idiomatic Scala interface for HTTP serv…9.1
• CVE-2021-39186GlobalNewFiles is a MediaWiki extension maintained by Mirahe…6.1
• CVE-2021-39189Pimcore is an open source data & experience management platf…5.3
• CVE-2021-3919A potential security vulnerability has been identified in OM…9.8
• CVE-2021-39190The SCCM plugin for GLPI is a plugin to synchronize computer…5.3
• CVE-2021-39191mod_auth_openidc is an authentication/authorization module f…6.1
• CVE-2021-39192Ghost is a Node.js content management system. An error in th…7.2
• CVE-2021-39193Frontier is Substrate's Ethereum compatibility layer. Prior …5.3