CVE-2026-34363: parse-server LiveQuery Field Leak Vulnerability
Summary
CVE-2026-34363: LiveQuery protected field leak via shared mutable state across concurrent subscribers. Affects parse-server across 2 version ranges.
< 8.6.65
>= 9.0.0, < 9.7.0-alpha.9
Fixed in 8.6.65 or 9.7.0-alpha.9, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-34363 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust server-side architecture. It provides features like data storage, user authentication, and real-time capabilities through LiveQuery. However, when multiple clients subscribe to the same class via LiveQuery, a vulnerability exists that can lead to the unintended exposure of sensitive data.
Vulnerability Detail
The vulnerability arises from the use of shared mutable state across concurrent subscribers in LiveQuery. When one subscriber modifies the shared object, it can inadvertently affect other subscribers, leading to the potential leakage of protected fields and authentication data. This issue is particularly critical when multiple clients are accessing the same class, as it can result in unauthorized access to sensitive information or incomplete data being sent to clients. The vulnerability is classified under CWE-362, indicating a race condition in the handling of shared resources.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.658.6.65npm install parse-server@8.6.65 -
>= 9.0.0, < 9.7.0-alpha.99.7.0-alpha.9npm install parse-server@9.7.0-alpha.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. It is recommended to apply the patches as soon as they are available to mitigate the risk.
Conclusion
The CVE-2026-34363 vulnerability in parse-server poses a significant risk due to the potential leakage of sensitive data through shared mutable state in LiveQuery. It is crucial for developers to update their packages to the patched versions to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for parse-server →
FAQ
The vulnerability involves a leak of protected fields due to shared mutable state across concurrent subscribers in LiveQuery.
Any Parse Server deployment using LiveQuery with protected fields or afterEvent triggers is affected when multiple clients subscribe to the same class.
Sensitive data may be exposed to unauthorized clients, or authorized clients may receive incomplete data, leading to security and functionality issues.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
