Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update

Özet

Türkçe özeti yalnızca kritik ve yüksek önemdeki açıklar için hazırlıyoruz. Bu açık için kaynağın kendi açıklamasını gösteriyoruz.

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…server/security/advisories/GHSA-wc3c-6843-q7mv Üretici bülteni
• github.com/parse-community/parse-server/pull/10802 Yama
• github.com/parse-community/parse-server/pull/10803 Yama
• vulncheck.com/…denial-of-service-via-aftersave-pointer-update Üçüncü taraf

Kayıt geçmişi

1. 3 Kas 2026 17:28Yayımlandı

İlgili açıklar

• 3,1 CVE-2026-122301Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 Information Disclosure via Object Create Response
• 5,3 CVE-2026-121965Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key
• 3,7 CVE-2026-121415Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
• 3,1 CVE-2026-121413Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession
• 3,1 CVE-2026-120310Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 Information Disclosure via Object Update Response
• 3,1 CVE-2026-119570Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses