CVE-2026-34532

npm/parse-server CVE-2026-34532: critical

parse-server has cloud function validator bypass via prototype chain traversal

Action: Upgrade parse-server to 8.6.67 or later.

npm i parse-server@9.7.0-alpha.11

npm i parse-server@8.6.67

Affected

Fixed versions

Sources

• osv: GHSA-vpj2-qq7w-5qq6
• https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6
• https://nvd.nist.gov/vuln/detail/CVE-2026-34532
• https://github.com/parse-community/parse-server/pull/10342
• https://github.com/parse-community/parse-server/pull/10343
• https://github.com/parse-community/parse-server/commit/4fc48cf28f22eea200d74d883505f485234a48d7
• https://github.com/parse-community/parse-server/commit/dc59e272665644083c5b7f6862d88ce1ef0b2674
• https://github.com/parse-community/parse-server

CVE-2026-34532 · published 2026-03-31T23:48:38Z · modified 2026-04-06T15:27:13.671937314Z · JSON