How many CVEs have patched ParseLiveQueryServer?

13 published CVEs changed ParseLiveQueryServer in parse-community/parse-server, in 25 distinct patches totalling 291 changed lines, between 2020 and 2026.

What is the latest CVE that changed ParseLiveQueryServer?

CVE-2026-57481 (Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change), published 2026-07-08, changed lines 396 to 424 of src/LiveQuery/ParseLiveQueryServer.ts.

How does ParseLiveQueryServer compare to the rest of parse-community/parse-server?

parse-community/parse-server has 79 CVEs with a located fix in total; 13 of them changed ParseLiveQueryServer.

What do the line numbers refer to?

Line numbers are in the fixed version of the file, as the upstream patch left it. A CVE whose fix was backported to several branches is listed once, with the lines from the upstream commit.

ParseLiveQueryServer in parse-community/parse-server: Patched by 13 CVEs

Parse Server: LiveQuery discloses object data to a subscriber across an ACL read-access change

CVE-2026-57481 · src/LiveQuery/ParseLiveQueryServer.ts · lines 396–424 · +29 −0

Low · CVSS 2.3

EPSS 0.5%2026-07-08

Parse Server: Denial of service via exponential-time processing of deeply nested query operators

CVE-2026-57480 · src/LiveQuery/ParseLiveQueryServer.ts · lines 1040–1065 · +16 −9

High · CVSS 8.7

EPSS 0.6%2026-07-08

Parse Server: LiveQuery protected-field guard bypass via array-like logical operator value

CVE-2026-34595 · src/LiveQuery/ParseLiveQueryServer.ts · lines 558–1117 · +16 −12 in 4 hunks

Medium · CVSS 5.3

EPSS 0.4%2026-03-31

Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers

CVE-2026-34363 · src/LiveQuery/ParseLiveQueryServer.ts · lines 209–775 · +19 −18 in 10 hunks

High · CVSS 8.2

EPSS 0.4%2026-03-31

Parse Server: LiveQuery subscription query depth bypass

CVE-2026-33508 · src/LiveQuery/ParseLiveQueryServer.ts · lines 1026–1054 · +28 −1

High · CVSS 8.2

EPSS 0.6%2026-03-24

Parse Server: Protected field change detection oracle via LiveQuery watch parameter

CVE-2026-33429 · src/LiveQuery/ParseLiveQueryServer.ts · lines 1053–1096 · +12 −1 in 2 hunks

Medium · CVSS 6.3

EPSS 0.4%2026-03-24

Parse Server: LiveQuery bypasses CLP pointer permission enforcement

CVE-2026-33421 · src/LiveQuery/ParseLiveQueryServer.ts · lines 214–671 · +11 −3 in 3 hunks

High · CVSS 7.1

EPSS 0.4%2026-03-24

Parse Server leaks protected fields via LiveQuery afterEvent trigger

CVE-2026-33163 · src/LiveQuery/ParseLiveQueryServer.ts · lines 252–430 · +6 −0 in 4 hunks

High · CVSS 8.2

EPSS 0.5%2026-03-18

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

CVE-2026-32878 · src/LiveQuery/ParseLiveQueryServer.ts · lines 28–588 · +2 −2 in 2 hunks

Medium · CVSS 5.3

EPSS 0.5%2026-03-18

Parse Server: LiveQuery subscription with invalid regular expression crashes server

CVE-2026-32770 · src/LiveQuery/ParseLiveQueryServer.ts · lines 193–1016 · +25 −9 in 3 hunks

High · CVSS 7.5

EPSS 0.7%2026-03-18

Protected fields exposed via LiveQuery

CVE-2022-31112 · src/LiveQuery/ParseLiveQueryServer.js · lines 13–356 · +25 −20 in 3 hunks

High · CVSS 8.2

EPSS 1.3%2022-06-30

LiveQuery publishes user session tokens in parse-server

CVE-2021-41109 · src/LiveQuery/ParseLiveQueryServer.js · lines 182–335 · +18 −0 in 2 hunks

High · CVSS 7.5

EPSS 1.2%2021-09-30

receiving subscription objects with deleted session

CVE-2020-15270 · src/LiveQuery/ParseLiveQueryServer.js · lines 58–520 · +5 −4 in 2 hunks

Medium · CVSS 4.3

EPSS 1.2%2020-10-22

ParseLiveQueryServer

Overview

CVEs that patched it

Other functions in these files

Other hotspots in the repository

Frequently asked questions

References

Track parse-community/parse-server CVEs