PT-2026-29165 · Unknown · Parse Server

Mtrezza · Published 2026-03-30 · Updated 2026-04-06 · CVE-2026-34363

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.65 Parse Server versions prior to 9.7.0-alpha.9

Description Parse Server, an open source backend deployable on Node.js infrastructures, is affected by an issue where sensitive data can leak to unauthorized clients or incomplete data can be received by authorized clients when multiple clients subscribe to the same class via LiveQuery. This occurs because event handlers process subscribers concurrently using shared mutable objects, and the sensitive data filter modifies these objects in-place. Additionally, modifications from one subscriber's afterEvent Cloud Code trigger can leak to other subscribers through the same shared mutable state. Any deployment utilizing LiveQuery with protected fields or afterEvent triggers is potentially affected.

Recommendations Parse Server versions prior to 8.6.65 should be updated to version 8.6.65 or later. Parse Server versions prior to 9.7.0-alpha.9 should be updated to version 9.7.0-alpha.9 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

BIT-PARSE-2026-34363

CVE-2026-34363

GHSA-M983-V2FF-WQ65

Affected Products

Parse Server

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34363.json · Exploit
• https://github.com/parse-community/parse-server/pull/10330 · Patch
• https://github.com/parse-community/parse-server/security/advisories/GHSA-m983-v2ff-wq65 · Vendor Advisory
• https://github.com/parse-community/parse-server/commit/5834e29234593addaa0251a85f572ad4f376320b · Patch
• https://github.com/parse-community/parse-server/commit/776c71c3078e77d38c94937f463741793609d055 · Patch
• https://github.com/parse-community/parse-server/pull/10331 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34363 · Security Note
• https://osv.dev/vulnerability/BIT-parse-2026-34363 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m983-v2ff-wq65 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34363 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://twitter.com/CVEnew/status/2039004431878926587 · Twitter Post
• https://twitter.com/cyberbivash/status/2039013902285988033 · Twitter Post