ZeroDay Findings
Sign inSign up

Findings

CVE-2026-34373

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js.

Published Mar 31, 2026 · updated Jul 24, 2026 · parseplatform parse-server

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction. This issue has been patched in versions 8.6.66 and 9.7.0-alpha.10.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 31, 2026 · NIST NVD

    Detected

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse

  2. Jul 24, 2026 · NIST NVD

    Updated

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse

Affected

  • cpe parseplatform/parse-serverversion unspecified
  • cpe parseplatform/parse-server9.7.0

Sources

  • CVE.orgVulnerability recordCVE-2026-34373

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-34373

    Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any w

    nvd.nist.gov

References