### Impact
Parse Server crashes when if a query request contains an invalid value for the `explain` option. This is due to a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch.

### Patches
Upgrade to Parse Server 4.10.3

Affected Packages

npm parse-server

Affected versions: 0 (fixed in 4.10.3)

Related CVEs

CVE-2021-39187

Key Information

GHSA ID

GHSA-xqp8-w826-hh6x

Published

September 2, 2021 4:51 PM

Last Modified

August 11, 2022 4:55 PM

CVSS Score

7.5 /10

Primary Ecosystem

npm

Primary Package

parse-server

GitHub Reviewed

✓ Yes

Dataset

Last updated: July 10, 2025 6:22 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.