CVE-2021-39187

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 4.10.3

Description The issue occurs when a query request contains an invalid value for the explain option, causing Parse Server to crash due to a bug in the MongoDB Node.js driver that throws an exception Parse Server cannot catch.

Recommendations For versions prior to 4.10.3, upgrade to Parse Server 4.10.3 to resolve the issue. As a temporary workaround, consider avoiding the use of the explain option in query requests until the patch is applied.