CVE-2022-31089: Invalid file request can crashe parse-server
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions certain types of invalid files requests are not handled properly and can crash the server. If you are running multiple Parse Server instances in a cluster, the availability impact may be low; if you are running Parse Server as single instance without redundancy, the availability impact may be high. This issue has been addressed in versions 4.10.12 and 5.2.3. Users are advised to upgrade. There are no known workarounds for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-31089?
CVE-2022-31089 is a vulnerability in Parse Server, an open source backend that can be used with Node.js, where certain types of invalid file requests are not handled properly and can crash the server.
What is the severity of CVE-2022-31089?
The severity of CVE-2022-31089 is high, with a CVSS score of 7.5.
How does CVE-2022-31089 impact Parse Server instances?
CVE-2022-31089 can cause the server to crash if it receives certain types of invalid file requests.
Which versions of Parse Server are affected by CVE-2022-31089?
Parse Server versions up to (but not including) 4.10.12 and versions 5.0.0 up to (but not including) 5.2.3 are affected by CVE-2022-31089.
How can I fix CVE-2022-31089?
To fix CVE-2022-31089, update Parse Server to a version that is not affected by the vulnerability.