npm/parse-server CVE-2026-33323: medium 5.3, EPSS 0.45%
Parse Server email verification resend page leaks user existence
Action: Upgrade parse-server to 8.6.51 or later.
npm i parse-server@9.6.0-alpha.40npm i parse-server@8.6.51Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.0.0 | 9.6.0-alpha.40 | - |
| 0 | 8.6.51 | - |
Fixed versions
| 9.6.0-alpha.40 | 8.6.51 |
Sources
- osv: GHSA-h29g-q5c2-9h4f
- https://github.com/parse-community/parse-server/security/advisories/GHSA-h29g-q5c2-9h4f
- https://nvd.nist.gov/vuln/detail/CVE-2026-33323
- https://github.com/parse-community/parse-server/pull/10238
- https://github.com/parse-community/parse-server/pull/10243
- https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5
- https://github.com/parse-community/parse-server/commit/fbda4cb0c5cbc8fad08a216823b6b64d4ae289c3
- https://github.com/parse-community/parse-server
CVE-2026-33323 · published · modified · JSON