{"schema":"threatline.record/2","record":{"id":"GHSA-46jj-qw3p-48fc","aliases":["GHSA-46jj-qw3p-48fc"],"summary":"Server crash via unhandled error when sending verification or password reset email","details":"### Impact\r\n\r\nParse Server does not handle an error that occurs while it sends a verification email or a password reset email. The error ends the Parse Server process. A client that only has the public application keys can cause Parse Server to send such an email, for example by signing up with an email address, requesting a new verification email, or requesting a password reset. If sending the email fails, for example because the mail provider rejects the request, applies a rate limit or is unavailable, the server process exits. Deployments are affected that configure an email adapter with email verification or password reset.\r\n\r\n### Patches\r\n\r\nAn error that occurs while sending a verification or password reset email is now caught and logged, instead of ending the process. Emails are still sent without delaying the response, and endpoint responses are unchanged.\r\n\r\n### Workarounds\r\n\r\nWrap the email adapter's send methods, and the `sendUserEmailVerification` function if configured, so that they catch and log errors instead of throwing or rejecting. To also cover errors that occur before the email adapter is called, register a `process.on('unhandledRejection', ...)` listener in the application that logs the rejection instead of letting it end the process.\r\n\r\n### References\r\n\r\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-46jj-qw3p-48fc\r\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10730\r\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10731\r\n","categories":["Unclassified"],"product":"parse-server","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-46jj-qw3p-48fc","source_modified_at":"2026-09-30T21:34:10Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"npm","name":"parse-server"},"range":">= 9.0.0, < 9.10.2-alpha.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-46jj-qw3p-48fc","source_modified_at":"2026-09-30T21:34:10Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"npm","name":"parse-server"},"range":"< 8.6.97"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-46jj-qw3p-48fc","source_modified_at":"2026-09-30T21:34:10Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"9.10.2-alpha.6"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-46jj-qw3p-48fc","source_modified_at":"2026-09-30T21:34:10Z","fetched_at":"2026-10-25T18:55:31.805249Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"8.6.97"}],"cvss":8.2,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-30T21:34:10Z","modified_at":"2026-09-30T21:34:10Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-46jj-qw3p-48fc","fetched_at":"2026-10-25T18:55:31.805249Z","source_modified_at":"2026-09-30T21:34:10Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-30T21:34:10Z","content_hash":"bd6ad48913df10a30d4a5d84763d0aff0cb2ad5d159277429b785a3a37b28756"}}