{"action":"Upgrade parse-server to 8.6.67 or later.","affected":[{"fixed":"9.7.0-alpha.11","introduced":"9.0.0"},{"fixed":"8.6.67","introduced":"0"}],"component":"parse-server","cve_ids":["CVE-2026-34532"],"ecosystem":"npm","epss":0.00282,"exploited":false,"fixed_versions":["9.7.0-alpha.11","8.6.67"],"ghsa_id":"GHSA-vpj2-qq7w-5qq6","id":"tcs_01M5KGCKCXJ5385CNCMVW4316V","modified_at":"2026-04-06T15:27:13.671937314Z","published_at":"2026-03-31T23:48:38Z","references":["https://osv.dev/vulnerability/GHSA-vpj2-qq7w-5qq6","https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6","https://nvd.nist.gov/vuln/detail/CVE-2026-34532","https://github.com/parse-community/parse-server/pull/10342","https://github.com/parse-community/parse-server/pull/10343","https://github.com/parse-community/parse-server/commit/4fc48cf28f22eea200d74d883505f485234a48d7","https://github.com/parse-community/parse-server/commit/dc59e272665644083c5b7f6862d88ce1ef0b2674","https://github.com/parse-community/parse-server"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-vpj2-qq7w-5qq6","url":"https://osv.dev/vulnerability/GHSA-vpj2-qq7w-5qq6"},{"source":"nvd","source_id":"CVE-2026-34532","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34532"}],"summary":"parse-server has cloud function validator bypass via prototype chain traversal"}