NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
📦 npm
Not in CISA KEV

CVE-2026-61448 — parse-server

CVE-2026-61448 is a Unrestricted File Upload vulnerability in parse-server. A fix is available for parse-server — see the affected versions and patch details below.

Parse Server 9.0.0 Stored XSS via malformed Content-Type

Also known asBIT-parse-2026-61448GHSA-r899-h629-j84r
Published
Updated
Affected
2 pkgs
Patched
2 / 2
Exploits
None indexed
Exploitation data as of Oct 30, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

  • CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-61448.

EPSS Exploitation Probability

via FIRST.org ↗
0.4%probability of exploitation in next 30 days
Lower Risk0.00%
Lower risk than most CVEs36th percentile — riskier than 36% of all scored CVEsHighest risk
0.00%0.30%0.61%0.92%0.2%0.4%0.4%0.4%Aug 26Oct 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

2 pkgs affected

How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.

62other npm packages depend on this — each one inherits the vulnerability until it's patched upstream
parse-servernpm
82Kdownloads / week

Description

Impact

Parse Server's file upload validation uses the fileUpload.fileExtensions option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the mime package, Parse Server preserves the client-supplied Content-Type and passes it to the storage adapter. A malformed Content-Type that is not a valid type/subtype media type — for example image (no subtype), image/ (empty subtype), or image//svg+xml (invalid token) — bypassed the blocklist and was stored unchanged. On storage adapters that persist and serve the uploaded Content-Type (such as Amazon S3, Google Cloud Storage, or Azure Blob Storage), a browser cannot parse the malformed Content-Type and falls back to MIME-sniffing the file content; a file whose body begins with HTML markup is then rendered as HTML, executing any embedded script in the application's origin. This allows a user permitted to upload files to store content that executes as script against other users who open the file URL. The default GridFS storage adapter is not affected, as it recomputes the Content-Type from the filename and serves files with X-Content-Type-Options: nosniff.

Patches

The file upload handler now validates that the client-supplied Content-Type is a well-formed media type (type/subtype with non-empty tokens per RFC 9110 §5.6.2) whenever the filename extension is not recognized by mime. Malformed values are rejected instead of being stored, while well-formed types — including custom or vendor types that the mime package does not recognize — continue to be accepted; only blocklisted subtypes are rejected.

Workarounds

Configure fileUpload.fileExtensions as a strict allowlist of only the extensions the application needs (for example ["^(png|jpe?g|gif|pdf)$"]). Additionally, serve uploaded files from a domain separate from the application so that any rendered content is isolated from the application's origin, and configure the storage/CDN layer to send X-Content-Type-Options: nosniff.

References

Affected Packages

2 total 2 fixed
EcosystemPackageVulnerable rangeFix
📦npmparse-server≥ 9.0.0&&< 9.10.0-alpha.29.10.0-alpha.2npm install parse-server@9.10.0-alpha.2
📦npmparse-serverall versions8.6.84npm install parse-server@8.6.84

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for parse-server, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Fix

    Update parse-server to 9.10.0-alpha.2 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-61448 is resolved across your whole dependency graph.

  3. Workarounds

    Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.

Frequently Asked Questions

### Impact Parse Server's file upload validation uses the `fileUpload.fileExtensions` option (enabled by default with a blocklist) to reject files that browsers may render as active content, mitigating stored cross-site scripting (XSS). When an uploaded file's extension is not recognized by the `mime` package, Parse Server preserves the client-supplied `Content-Type` and passes it to the storage adapter. A malformed `Content-Type` that is not a valid `type/subtype` media type — for example `image` (no subtype), `image/` (empty subtype), or `image//svg+xml` (invalid token) — bypassed the block
O3 Security · Impact-Aware SCA

Is CVE-2026-61448 in your dependencies?

Find it across npm, including transitive dependencies.

Scan my dependencies How O3 SCA works
CVE-2026-61448: parse-server XSS — Fix Available