CVE-2026-34363

Workarounds

There is no known workaround.

Resources

• GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-m983-v2ff-wq65
• Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10330
• Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10331

When multiple clients subscribe to the same class via LiveQuery, the event handlers process each subscriber concurrently using shared mutable objects. The sensitive data filter modifies these shared objects in-place, so when one subscriber's filter removes a protected field, subsequent subscribers may receive the already-filtered object. This can cause protected fields and authentication data to leak to clients that should not see them, or cause clients that should see the data to receive an incomplete object.

Additionally, when an afterEvent Cloud Code trigger is registered, one subscriber's trigger modifications can leak to other subscribers through the same shared mutable state.

Any Parse Server deployment using LiveQuery with protected fields or afterEvent triggers is affected when multiple clients subscribe to the same class.

Multiple concurrent operations access a shared resource without proper synchronization, producing unpredictable results depending on timing. Typical impact: TOCTOU exploits, data corruption, or privilege escalation.

Kodem intelligence

The fix deep-clones the shared objects at the start of each subscriber's processing callback, ensuring each subscriber works on an independent copy. Additionally, a bug was fixed where master key LiveQuery clients could not receive events on classes with protected fields due to an incorrect type passed to the sensitive data filter.

1. What is CVE-2026-34363? CVE-2026-34363 is a high-severity race condition vulnerability in parse-server (npm), affecting versions >= 9.0.0, < 9.7.0-alpha.9. It is fixed in 9.7.0-alpha.9, 8.6.65. Multiple concurrent operations access a shared resource without proper synchronization, producing unpredictable results depending on timing.
2. Which versions of parse-server are affected by CVE-2026-34363? parse-server (npm) versions >= 9.0.0, < 9.7.0-alpha.9 is affected.
3. Is there a fix for CVE-2026-34363? Yes. CVE-2026-34363 is fixed in 9.7.0-alpha.9, 8.6.65. Upgrade to this version or later.
4. Is CVE-2026-34363 exploitable, and should I be worried? Whether CVE-2026-34363 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-34363 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-34363?
   • Upgrade parse-server to 9.7.0-alpha.9 or later
   • Upgrade parse-server to 8.6.65 or later