npm/parse-server CVE-2026-34363: high, EPSS 0.40%
LiveQuery protected field leak via shared mutable state across concurrent subscribers
Action: Upgrade parse-server to 8.6.65 or later.
npm i parse-server@9.7.0-alpha.9npm i parse-server@8.6.65Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.0.0 | 9.7.0-alpha.9 | - |
| 0 | 8.6.65 | - |
Fixed versions
| 9.7.0-alpha.9 | 8.6.65 |
Sources
- osv: GHSA-m983-v2ff-wq65
- https://github.com/parse-community/parse-server/security/advisories/GHSA-m983-v2ff-wq65
- https://nvd.nist.gov/vuln/detail/CVE-2026-34363
- https://github.com/parse-community/parse-server/pull/10330
- https://github.com/parse-community/parse-server/pull/10331
- https://github.com/parse-community/parse-server/commit/5834e29234593addaa0251a85f572ad4f376320b
- https://github.com/parse-community/parse-server/commit/776c71c3078e77d38c94937f463741793609d055
- https://github.com/parse-community/parse-server
CVE-2026-34363 · published · modified · JSON