Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Versions prior to 4.10.17, and prior to 5.2.8 on the 5.x branch, crash when a file download request is received with an invalid byte range, resulting in a Denial of Service. This issue has been patched in versions 4.10.17, and 5.2.8. There are no known workarounds.
Remediation
References
https://github.com/parse-community/parse-server/security/advisories/GHSA-h423-w6qv-2wj3
Related Vulnerabilities
CVE-2017-16101 Vulnerability in npm package serverwg
CVE-2019-16560 Vulnerability in maven package org.jenkins-ci.plugins:websphere-deployer
CVE-2020-26302 Vulnerability in maven package org.webjars.npm:is_js
CVE-2017-16138 Vulnerability in maven package org.webjars.npm:mime
CVE-2021-32808 Vulnerability in maven package org.webjars.npm:ckeditor4