Executive brief
Parse Server is a backend-as-a-service platform that enforces security policies on incoming API requests through a denylist of prohibited keywords. A logic bug allows attackers to bypass this security control by placing nested objects or arrays before forbidden keywords, potentially enabling unauthorized data access or manipulation. This affects all Parse Server deployments since the denylist is enabled by default.
Technical details
The vulnerability is a logic bug (CWE-693) in the requestKeywordDenylist recursive scanner that prematurely exits the scan loop after encountering the first nested value, failing to inspect sibling keys at the same level. An attacker can craft a request payload placing any nested object or array before a prohibited keyword to bypass the denylist check. The attack is network-accessible, requires no authentication or user interaction, and affects all Parse Server versions before 8.6.12 and 9.0.0 before 9.5.1-alpha.1. The fix replaces the recursive scanner with an iterative stack-based traversal that properly processes all nested structures and also mitigates potential stack overflow on deeply nested payloads.
Affected products
- Parse Community Parse Server before 8.6.12, and 9.0.0 before 9.5.1-alpha.1
Timeline
- 2026-03-10: disclosed
- 2026-03-10: patched: Parse Server 8.6.12 and 9.5.1-alpha.1 released