CVE-2022-31089

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as single instance without redundancy, the availability impact may be high. This issue has been addressed in versions 4.10.12 and 5.2.3. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-252
• CWE-706

• https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92Patch, Third Party Advisory
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9Third Party Advisory
• https://github.com/parse-community/parse-server/commit/5be375dec2fa35425c1003ae81c55995ac72af92Patch, Third Party Advisory
• https://github.com/parse-community/parse-server/security/advisories/GHSA-xw6g-jjvf-wwf9Third Party Advisory

Published

Jun 27, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-31083Parse Server is an open source backend that can be deployed …7.5
• CVE-2022-31084LDAP Account Manager (LAM) is a webfrontend for managing ent…8.1
• CVE-2022-31085LDAP Account Manager (LAM) is a webfrontend for managing ent…6.1
• CVE-2022-31086LDAP Account Manager (LAM) is a webfrontend for managing ent…8.8
• CVE-2022-31087LDAP Account Manager (LAM) is a webfrontend for managing ent…7.8
• CVE-2022-31088LDAP Account Manager (LAM) is a webfrontend for managing ent…5.3
• CVE-2022-3109An issue was discovered in the FFmpeg package, where vp3_dec…7.5
• CVE-2022-31090Guzzle, an extensible PHP HTTP client. `Authorization` heade…7.7
• CVE-2022-31091Guzzle, an extensible PHP HTTP client. `Authorization` and `…7.7
• CVE-2022-31092Pimcore is an Open Source Data & Experience Management Platf…8.1
• CVE-2022-31093NextAuth.js is a complete open source authentication solutio…7.5
• CVE-2022-31094ScratchTools is a web extension designed to make interacting…6.1