CVE-2026-34784: parse-server File Download Bypass Vulnerability
Summary
CVE-2026-34784: Parser Server's streaming file download bypasses afterFind file trigger authorization. Affects parse-server across 2 version ranges.
< 8.6.71
>= 9.0.0, < 9.7.1-alpha.1
Fixed in 8.6.71 or 9.7.1-alpha.1, depending on the release line you run. How to fix ↓
Also tracked for
- parse · Bitnami
The same CVE-2026-34784 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend framework that enables developers to build applications with a robust server-side infrastructure. It supports various features such as data storage, user authentication, and file management. However, it has been identified that certain file download mechanisms can bypass security triggers, potentially exposing sensitive files.
Vulnerability Detail
The vulnerability arises from the handling of HTTP Range requests for file downloads in Parse Server. Specifically, the afterFind(Parse.File) trigger, which is intended to enforce authorization and validation, is bypassed when files are accessed via streaming. This flaw allows unauthorized users to access files that should be protected, leading to potential data leaks and unauthorized access to sensitive information.
How To Fix
Latest published version: 9.10.5 as of 22 Oct 2026
npm install parse-server@9.10.5Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 8.6.718.6.71npm install parse-server@8.6.71 -
>= 9.0.0, < 9.7.1-alpha.19.7.1-alpha.1npm install parse-server@9.7.1-alpha.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, use the beforeFind(Parse.File) trigger for file access authorization. This trigger runs on all download paths, including streaming, ensuring that authorization checks are performed before file access. Example code for implementing the workaround:
Parse.Cloud.beforeFind(Parse.File, async (request) => {
const user = request.user;
if (!user) {
throw new Parse.Error(Parse.Error.UNAUTHORIZED, 'User must be logged in to access this file.');
}
});
Conclusion
The CVE-2026-34784 vulnerability in parse-server allows unauthorized file access through HTTP Range requests, bypassing critical authorization checks. It is crucial to update to the latest patched version or implement the recommended workaround to secure your application.
See every vulnerability recorded for parse-server →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to unauthorized access to sensitive files, resulting in data leaks and potential breaches of user privacy.
Yes, the permanent fix is to update the parse-server package to the specified patched versions.
If immediate updates are not possible, implement the suggested workaround using the beforeFind(Parse.File) trigger to enforce authorization.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse-server.
