CVE-2026-39321

npm/parse-server CVE-2026-39321: low 3.7, EPSS 0.37%

Parse Server has a login timing side-channel reveals user existence

Action: Upgrade parse-server to 8.6.74 or later.

npm i parse-server@9.8.0-alpha.6

npm i parse-server@8.6.74

Affected

Fixed versions

Sources

• osv: GHSA-mmpq-5hcv-hf2v
• https://github.com/parse-community/parse-server/security/advisories/GHSA-mmpq-5hcv-hf2v
• https://nvd.nist.gov/vuln/detail/CVE-2026-39321
• https://github.com/parse-community/parse-server/pull/10398
• https://github.com/parse-community/parse-server/pull/10399
• https://github.com/parse-community/parse-server

CVE-2026-39321 · published 2026-04-08T00:07:10Z · modified 2026-04-15T21:34:44.865456Z · JSON