Vulnerability in Parse-community Parse-server
CVE-2026-33323
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.51 and 9.6.0-alpha.40, the Pages route and legacy PublicAPI route for resending email verification links return d…
EPSS: 0.001 (16.1th percentile) — read the EPSS interpretation.
Affected products
- Parse-community Parse-server — versions < 8.6.51, >= 9.0.0, < 9.6.0-alpha.40
Weakness classification (CWE)
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-h29g-q5c2-9h4f (x_refsource_CONFIRM)
- https://github.com/parse-community/parse-server/pull/10238 (x_refsource_MISC)
- https://github.com/parse-community/parse-server/pull/10243 (x_refsource_MISC)
- https://github.com/parse-community/parse-server/commit/967aa57732202009b2389ce9ecb3130d53d657e5 (x_refsource_MISC)
- https://github.com/parse-community/parse-server/commit/fbda4cb0c5cbc8fad08a216823b6b64d4ae289c3 (x_refsource_MISC)