npm/parse-server CVE-2026-34574: medium, EPSS 0.34%
Parse Server has a session field immutability bypass via falsy-value guard
Action: Upgrade parse-server to 8.6.69 or later.
npm i parse-server@9.7.0-alpha.14npm i parse-server@8.6.69Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.0.0 | 9.7.0-alpha.14 | - |
| 0 | 8.6.69 | - |
Fixed versions
| 9.7.0-alpha.14 | 8.6.69 |
Sources
- osv: GHSA-f6j3-w9v3-cq22
- https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22
- https://nvd.nist.gov/vuln/detail/CVE-2026-34574
- https://github.com/parse-community/parse-server/pull/10347
- https://github.com/parse-community/parse-server/pull/10348
- https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21
- https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777
- https://github.com/parse-community/parse-server
CVE-2026-34574 · published · modified · JSON