Shipped · Databases

What parse-community/parse-server shipped

The public repository of Parseplatform · github.com/parse-community/parse-server

Written by FoxPlug from the repository's own releases; not affiliated with Parseplatform. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/parse-community/parse-server; Parseplatform did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

See the update FoxPlug writes for parse-server, free

Week of November 2, 2026

What shipped

Why it matters

This week brings several security fixes around dot notation writes and reads in objects, including cases where a beforeSave trigger could be bypassed or the server process terminated, plus a fix for nested $regex in query operators and a fix for schema migration deleting internal indexes on server start. It also adds Node.js 26 support and moves the Docker image off Node.js 20. Users on the affected lines should upgrade to the releases carrying these fixes.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: security fixes for dot notation object writes that could bypass beforeSave triggers or terminate the server, a fix for nested $regex with requestComplexity.allowRegex disabled, a schema migration fix for internal indexes, Node.js 26 support, and Docker images moved off

Post for LinkedIn

This week's releases focus on security and stability. Dot notation object writes can no longer change a field that a beforeSave trigger reverts or keeps constant, an object update with a dot notation key no longer terminates the server when the class has a beforeSave trigger, and a dot notation operation on a missing field no longer reveals whether the field is stored to a caller without read access. Installation update also checks the caller's write permission before rejecting a changed device type or installation ID. Additionally, requestComplexity.allowRegex now rejects $regex nested in other query operators, schema migration no longer deletes internal indexes created on server start, Node.js 26 is supported, and the Docker image moves off Node.js 20.

Week of October 26, 2026

What shipped

Why it matters

This week brought three security fixes to Parse Server, each shipped on both the 8.x line and the alpha line. Two address LiveQuery and dot notation behaviour that exposed information to callers lacking the master key or read access, and one changes the order in which installation updates check write permission. People running the project should upgrade to the patched 8.x release.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

New Parse Server releases fix three security issues: LiveQuery subscriptions receiving internal-class objects without the master key, dot notation revealing stored fields to callers without read access, and installation update permission checks. Patch releases are out for 8.x and

Post for LinkedIn

Parse Server shipped three security fixes this week, each released on the 8.x line and the alpha line. LiveQuery subscriptions can no longer receive installations and objects of other internal classes without the master key. A dot notation operation on a missing field no longer reveals whether the field is stored to a caller without read access. Installation updates now check the caller's write permission before rejecting a changed device type or installation ID. Patch releases are available for both lines, and upgrading is recommended.

Week of October 19, 2026

What shipped

Why it matters

This week brought several security fixes to released versions, covering denial of service in email format validation and save responses that leaked whether fields are stored to callers without read access. Additional fixes for dot notation keys, prototype pollution during object writes and session upgrade behavior are in progress. A performance change also removes an extra database read when saving an object, reducing load on deployments.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: 9.10.7 and backports fix a pre-auth denial of service in email format validation and a save response that leaked stored field state. Object create and update also stopped returning field values to callers without read access. Saving an object now skips an extra databas

Post for LinkedIn

This week's releases address several security issues and one performance improvement. Version 9.10.7 and the 8.6.x backports fix a pre-authentication denial of service caused by regex backtracking in email address format validation. Save responses no longer reveal whether a field is stored to a caller without read access, and earlier 9.10.6 releases stopped object create and update from returning field values to callers without read access. Fixes for dot notation key handling, including prototype pollution and a server termination case, and for the session upgrade endpoint are in review. Saving an object also no longer performs an additional database read.

Week of October 12, 2026

What shipped

Why it matters

This week is mostly security work on the release lines: several object update and write paths could return stored values to callers without read access or behave differently than the addressed object. Releases 8.6.109 and 9.10.5 carry those fixes plus the auth adapter and installation update corrections, and the docs were clarified so the read access rules for update responses are easier to follow.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Weekly digest: object update responses no longer return stored field values to callers without read access, installation updates target the addressed object, crafted keys can no longer pollute a shared prototype, and requestKeywordDenylist now covers keys, include and excludeKeys

Post for LinkedIn

This week brought a set of security fixes to parse-server. Object update responses no longer return stored field values to a caller without read access, installation updates are written to the addressed object rather than the installation named by the request's installation ID, object writes with a crafted key can no longer pollute a shared prototype and cause denial of service, and writes with a dot notation key no longer skip afterSave triggers and LiveQuery events. The requestKeywordDenylist option now also applies to the query parameters keys, include and excludeKeys. Documentation now clarifies how read access limits the fields of an update response. Releases 8.6.109 and 9.10.5 shipped with these fixes.

Week of October 5, 2026

What shipped

Why it matters

This week brought a large batch of security fixes across release branches 8.6.x and 9.10.5-alpha, covering query operators, LiveQuery, SMS MFA, custom auth adapters, class schema deletion and reserved field names. If you run Parse Server in production, upgrading takes you onto versions where those access-control bypasses and internal server errors are closed. Two non-security fixes also landed: batch and direct access for unusual object IDs and class names, and GraphQL name collisions.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Security-heavy week for Parse Server. Relation $relatedTo ACL bypass, LiveQuery $or cross-user events, SMS MFA master-privilege writes and auth adapter authData validation are all fixed in 8.6.x and 9.10.5-alpha. Malformed $or/$and/$nor/$options queries no longer 500. Please upgr

Post for LinkedIn

This week's Parse Server releases are mostly security fixes. Relation $relatedTo queries using an operator instead of an object ID could bypass owning-object ACL. LiveQuery subscriptions using a $or query could receive another user's events, including session tokens. SMS MFA login code requests saved other login request fields with master privileges. Custom auth adapters extending AuthAdapter accepted any authData. Unauthenticated deletion of class schemas removed class-level permissions on MongoDB, and object writes with a reserved field name could make reads fail. Login with the master key no longer overwrites stored MFA settings, and malformed $or, $and, $nor and $options operators no longer cause an internal server error. Fixes are available on the 8.6.x and 9.10.5-alpha lines.

Week of September 28, 2026

What shipped

Why it matters

This week addressed multiple security vulnerabilities across permission enforcement, session handling, and batch operations. Class-level permissions fixes and authorization checks improve data protection. Several test infrastructure improvements reduce flakiness and deployment issues.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Parse Server releases this week include security fixes for user update authorization, session creation permissions, class-level permission enforcement, and transactional batch request handling. Update recommended.

Post for LinkedIn

Parse Server shipped multiple security fixes this week addressing authorization and permission enforcement issues. Updates include fixes for user update checks running against target accounts before authorization, session creation bypassing class-level permissions, and transactional batch requests affecting other clients. These changes strengthen access control and data protection across the server.

Week of September 21, 2026

What shipped

Why it matters

Version 9.10.1 addresses multiple security vulnerabilities in GraphQL introspection, field-level access control, and authentication. LiveQuery fixes ensure permission evaluation matches REST API behavior. Critical dependency updates resolve production vulnerabilities.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Parse Server 9.10.1 released: fixes for query explain triggers, LDAP auth, GraphQL introspection disclosures, LiveQuery permissions, and critical dependency updates.

Post for LinkedIn

Parse Server 9.10.1 is now available. This release includes fixes for security vulnerabilities in GraphQL introspection and field access control, resolves LiveQuery permission evaluation inconsistencies with the REST API, addresses an LDAP authentication account takeover issue, and updates critical production dependencies including protobufjs.

More from parse-community/parse-server on GitHub

Merged pull requests

Weeks with too little public activity are left out rather than filled in. Last updated 2026-11-09.

Is this your repo? Ask us to remove this page.