CVE-2021-39187: 
JavaScript vulnerability analysis and mitigation

Parse Server, an open source backend that can be deployed to any infrastructure running Node.js, was found to contain a vulnerability (CVE-2021-39187) where the server crashes when a query request contains an invalid value for the explain option. This vulnerability was discovered in versions prior to 4.10.3 and was disclosed on September 2, 2021. The issue stems from a bug in the MongoDB Node.js driver which throws an exception that Parse Server cannot catch (GitHub Advisory).

The vulnerability occurs when processing query requests with invalid explain parameter values. The MongoDB Node.js driver throws an uncatchable exception when using unified topology (a MongoDB driver feature) and receiving invalid explain values. The issue is specifically related to the query parameter validation process and affects the server's stability. The vulnerability has been assigned a CVSS v2.0 score of 4.3 (MEDIUM) (NVD).

When exploited, this vulnerability causes the Parse Server to crash, potentially leading to a denial of service condition. This affects the availability of the server and could impact applications relying on the Parse Server infrastructure (GitHub Advisory).

The vulnerability has been patched in Parse Server version 4.10.3. Users are advised to upgrade to this version or later as there are no known workarounds for this issue (GitHub Advisory).