Vulnerability in Parse-community Parse-server
CVE-2026-34363
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.65 and 9.7.0-alpha.9, when multiple clients subscribe to the same class via LiveQuery, the event handlers process…
Vulnerability class: Race Condition
EPSS: 0.000 (6.8th percentile) — read the EPSS interpretation.
Affected products
- Parse-community Parse-server — versions < 8.6.65, >= 9.0.0, < 9.7.0-alpha.9
Weakness classification (CWE)
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-m983-v2ff-wq65 (x_refsource_CONFIRM)
- https://github.com/parse-community/parse-server/pull/10330 (x_refsource_MISC)
- https://github.com/parse-community/parse-server/pull/10331 (x_refsource_MISC)
- https://github.com/parse-community/parse-server/commit/5834e29234593addaa0251a85f572ad4f376320b (x_refsource_MISC)
- https://github.com/parse-community/parse-server/commit/776c71c3078e77d38c94937f463741793609d055 (x_refsource_MISC)