{"action":"Upgrade parse-server to 8.6.69 or later.","affected":[{"fixed":"9.7.0-alpha.14","introduced":"9.0.0"},{"fixed":"8.6.69","introduced":"0"}],"component":"parse-server","cve_ids":["CVE-2026-34574"],"ecosystem":"npm","epss":0.0021,"exploited":false,"fixed_versions":["9.7.0-alpha.14","8.6.69"],"ghsa_id":"GHSA-f6j3-w9v3-cq22","id":"tcs_01M5KFMPMHX35FZK7HADWVRMCZ","modified_at":"2026-04-06T15:27:15.966361294Z","published_at":"2026-04-01T00:03:19Z","references":["https://osv.dev/vulnerability/GHSA-f6j3-w9v3-cq22","https://github.com/parse-community/parse-server/security/advisories/GHSA-f6j3-w9v3-cq22","https://nvd.nist.gov/vuln/detail/CVE-2026-34574","https://github.com/parse-community/parse-server/pull/10347","https://github.com/parse-community/parse-server/pull/10348","https://github.com/parse-community/parse-server/commit/90802969fc713b7bc9733d7255c7519a6ed75d21","https://github.com/parse-community/parse-server/commit/ebccd7fe2708007e62f705ee1c820a6766178777","https://github.com/parse-community/parse-server"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-f6j3-w9v3-cq22","url":"https://osv.dev/vulnerability/GHSA-f6j3-w9v3-cq22"}],"summary":"Parse Server has a session field immutability bypass via falsy-value guard"}