CVE-2026-33323

npm/parse-server CVE-2026-33323: medium 5.3

Parse Server email verification resend page leaks user existence

Action: Upgrade parse-server to 8.6.51 or later.

npm i parse-server@9.6.0-alpha.40

npm i parse-server@8.6.51

Affected

Fixed versions

Sources

• osv: GHSA-h29g-q5c2-9h4f
• https://github.com/parse-community/parse-server/security/advisories/GHSA-h29g-q5c2-9h4f
• https://nvd.nist.gov/vuln/detail/CVE-2026-33323
• https://github.com/parse-community/parse-server/pull/10238
• https://github.com/parse-community/parse-server/pull/10243
• https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5
• https://github.com/parse-community/parse-server/commit/fbda4cb0c5cbc8fad08a216823b6b64d4ae289c3
• https://github.com/parse-community/parse-server

CVE-2026-33323 · published 2026-03-19T18:21:18Z · modified 2026-03-30T14:05:51.429725Z · JSON