CVE-2026-34373

npm/parse-server CVE-2026-34373: medium, EPSS 0.24%

GraphQL API endpoint ignores CORS origin restriction

Action: Upgrade parse-server to 8.6.66 or later.

npm i parse-server@9.7.0-alpha.10

npm i parse-server@8.6.66

Affected

Fixed versions

Sources

• osv: GHSA-q3p6-g7c4-829c
• https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c
• https://nvd.nist.gov/vuln/detail/CVE-2026-34373
• https://github.com/parse-community/parse-server/pull/10334
• https://github.com/parse-community/parse-server/pull/10335
• https://github.com/parse-community/parse-server/commit/0347641507891d0013ec57f7c10f012064f41263
• https://github.com/parse-community/parse-server/commit/4dd0d3d8be1c39664c74ad10bb0abaa76bc41203
• https://github.com/parse-community/parse-server

CVE-2026-34373 · published 2026-03-30T18:05:47Z · modified 2026-04-06T15:27:10.053932311Z · JSON