LoginSign Up
← Back to all sparks
P

Parse Server

INFRA · APIS
Velocity5.0

Open-source backend platform for mobile and web apps

parseplatform.org ↗

Parse Server's 9.10.7 alphas fix a pre-auth regex DoS and two more read-access leaks.

backend-as-a-servicesecurity-advisoriesopen-sourcenodejsaccess-control
◆Current state
Parse Server is shipping near-daily alphas driven by security advisories. 9.10.7 so far fixes a pre-authentication denial of service from email regex backtracking and a save response that revealed whether a field exists to callers without read access, then trims an extra database read on save. 9.10.6-alpha.6 closed a similar leak on object creation.
◆Where it's heading
Two alpha series in two weeks have been mostly advisories on the write path: dot-notation keys, session upgrades, and responses that return or reveal fields a caller can't read. The project is systematically closing response-side data exposure, and only now mixing in performance work.
◆Prediction
Expect more GHSA fixes in 9.10.7 alphas before a stable cut, with the read-access checks on write responses the likely focus.

◆Recent moves

  1. 5d ago

    Saves skip an extra database read

    Saving an object no longer triggers an extra database read. A rare performance change in a run of security alphas, and it should reduce write latency across the board.

    View source ↗
  2. 5d ago

    Fix duplicate logging in save read-access check

    Cleans up logging from the alpha.2 read-access check, which was logging errors twice or at the wrong level.

    View source ↗
  3. 6d ago

    Fix: save responses revealed hidden fields' existence

    Another response-side leak closed under an advisory: save responses could reveal whether a field is stored to someone without read access. It continues the pattern of tightening what write responses return.

    View source ↗
  4. 6d ago

    Fix: pre-auth DoS via email regex backtracking

    A pre-authentication denial of service via regex backtracking on email format checks. Because no login is needed, it is the most exposed bug in the recent advisory run.

    View source ↗
  5. 7d ago

    Fix: create responses returned unreadable fields

    Object creation could return field values the caller had no right to read. The 9.10.6 series ends where it started, on response-side leaks.

    View source ↗
  6. 8d ago

    Fix: dot-notation keys could pollute prototypes via triggers

    Another GHSA fix on the write path: a crafted dot-notation key could pollute a shared prototype on classes with triggers or LiveQuery. It is the third dot-notation advisory in the 9.10.6 alphas, so the key-parsing code looks like the audit's main seam.

    View source ↗