parse-server: Server crash via unhandled error when sending verification or password reset email

Impact

Parse Server does not handle an error that occurs while it sends a verification email or a password reset email. The error ends the Parse Server process. A client that only has the public application keys can cause Parse Server to send such an email, for example by signing up with an email address, requesting a new verification email, or requesting a password reset. If sending the email fails, for example because the mail provider rejects the request, applies a rate limit or is unavailable, the server process exits. Deployments are affected that configure an email adapter with email verification or password reset.

Patches

An error that occurs while sending a verification or password reset email is now caught and logged, instead of ending the process. Emails are still sent without delaying the response, and endpoint responses are unchanged.

Workarounds

Wrap the email adapter's send methods, and the sendUserEmailVerification function if configured, so that they catch and log errors instead of throwing or rejecting. To also cover errors that occur before the email adapter is called, register a process.on('unhandledRejection', ...) listener in the application that logs the rejection instead of letting it end the process.

References

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-46jj-qw3p-48fc
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10730
• Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10731