SSRF in Parse-community Parse-server
CVE-2025-64430
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions 4.2.0 through 7.5.3, and 8.0.0 through 8.3.1-alpha.1, there is a Server-Side Request Forgery (SSRF) vulnerability in the fi…
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.001 (22.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Parse-community Parse-server — versions >= 4.2.0, < 7.5.4, >= 8.0.0, <= 8.4.0-alpha.1
Weakness classification (CWE)
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-x4qj-2f4q-r4rx (x_refsource_CONFIRM)
- https://github.com/parse-community/parse-server/pull/9903 (x_refsource_MISC)
- https://github.com/parse-community/parse-server/pull/9904 (x_refsource_MISC)
- https://github.com/parse-community/parse-server/commit/8bbe3efbcf4a3b66f4a8db9bfb18cd98c050db51 (x_refsource_MISC)
- https://github.com/parse-community/parse-server/commit/97763863b72689a29ad7a311dfb590c3e3c50585 (x_refsource_MISC)
Frequently asked questions
- What is CVE-2025-64430?
- CVE-2025-64430 is a high-severity vulnerability in Parse-community Parse-server, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.5/10. Published 2025-11-07.
- How severe is CVE-2025-64430?
- High severity. CVSS v3 base score is 7.5 out of 10.