CVE-2026-34784
1 advisory.
npm/parse-server CVE-2026-34784: high, EPSS 0.47%
Parser Server's streaming file download bypasses afterFind file trigger authorization
Action: Upgrade parse-server to 8.6.71 or later.
npm i parse-server@9.7.1-alpha.1npm i parse-server@8.6.71Affected
| introduced | fixed | last affected |
|---|---|---|
| 9.0.0 | 9.7.1-alpha.1 | - |
| 0 | 8.6.71 | - |
Fixed versions
| 9.7.1-alpha.1 | 8.6.71 |
Sources
- osv: GHSA-hpm8-9qx6-jvwv
- https://github.com/parse-community/parse-server/security/advisories/GHSA-hpm8-9qx6-jvwv
- https://nvd.nist.gov/vuln/detail/CVE-2026-34784
- https://github.com/parse-community/parse-server/pull/10361
- https://github.com/parse-community/parse-server/pull/10362
- https://github.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337
- https://github.com/parse-community/parse-server/commit/a0b0c69fc44f87f80d793d257344e7dcbf676e22
- https://github.com/parse-community/parse-server
CVE-2026-34784 · published · modified · JSON