Vulnerability in parse-community parse-server

[ Description ]Official description

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv
• www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.2-alpha.5-transactional-bat…