Threats tagged 'ghsa-vp2c-fv9g-pc39'

Parse Server versions before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 contain a vulnerability where a serialization error is not properly handled during an object update using a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. This flaw allows attackers, including unauthenticated clients if objects are writable without a session, to send such updates and cause the Node.js process to crash, resulting in a denial of service.