CVE-2026-34215

npm/parse-server CVE-2026-34215: high, EPSS 0.53%

Parse Server exposes auth data via verify password endpoint

Action: Upgrade parse-server to 8.6.63 or later.

npm i parse-server@9.7.0-alpha.7

npm i parse-server@8.6.63

Affected

Fixed versions

Sources

• osv: GHSA-wp76-gg32-8258
• https://github.com/parse-community/parse-server/security/advisories/GHSA-wp76-gg32-8258
• https://nvd.nist.gov/vuln/detail/CVE-2026-34215
• https://github.com/parse-community/parse-server/pull/10278
• https://github.com/parse-community/parse-server/pull/10279
• https://github.com/parse-community/parse-server/pull/10323
• https://github.com/parse-community/parse-server/pull/10324
• https://github.com/parse-community/parse-server/commit/5b8998e6866bcf75be7b5bb625e27d23bfaf912c
• https://github.com/parse-community/parse-server/commit/770be8647424d92f5425c41fa81065ffbbb171ed
• https://github.com/parse-community/parse-server/commit/875cf10ac979bd60f70e7a0c534e2bc194d6982f
• https://github.com/parse-community/parse-server/commit/a1d4e7b12a12f16d3870dbee582a36765858e94c
• https://github.com/parse-community/parse-server

CVE-2026-34215 · published 2026-03-29T15:14:03Z · modified 2026-04-06T15:27:09.751459049Z · JSON