CVE-2026-34363

🗓️ 31 Mar 2026 14:35:42Reported by GitHub_MType

Parse Server LiveQuery leaks protected fields via shared state among subscribers; fixed in 8.6.65 and 9.7.0-alpha.9.

Reporter	Title	Published	Views	Family All 16
ATTACKERKB	CVE-2026-34363	31 Mar 202614:35	–	attackerkb
Circl	CVE-2026-34363	31 Mar 202616:14	–	circl
CNNVD	Parse Server 竞争条件问题漏洞	31 Mar 202600:00	–	cnnvd
Cvelist	CVE-2026-34363 Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers	31 Mar 202614:35	–	cvelist
Github Security Blog	LiveQuery protected field leak via shared mutable state across concurrent subscribers	30 Mar 202617:40	–	github
NVD	CVE-2026-34363	31 Mar 202615:16	–	nvd
OSV	BIT-PARSE-2026-34363 Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers	6 Apr 202614:49	–	osv
OSV	CVE-2026-34363 Parse Server: LiveQuery protected field leak via shared mutable state across concurrent subscribers	31 Mar 202614:35	–	osv
OSV	GHSA-M983-V2FF-WQ65 LiveQuery protected field leak via shared mutable state across concurrent subscribers	30 Mar 202617:40	–	osv
Positive Technologies	PT-2026-29165	30 Mar 202600:00	–	ptsecurity

NVD

Vulners

Node

parseplatform parse-serverRange<8.6.65node.js

parseplatform parse-serverRange9.0.0–9.7.0node.js

parseplatform parse-serverMatch9.7.0alpha1node.js

parseplatform parse-serverMatch9.7.0alpha2node.js

parseplatform parse-serverMatch9.7.0alpha3node.js

parseplatform parse-serverMatch9.7.0alpha4node.js

parseplatform parse-serverMatch9.7.0alpha5node.js

parseplatform parse-serverMatch9.7.0alpha6node.js

parseplatform parse-serverMatch9.7.0alpha7node.js

parseplatform parse-serverMatch9.7.0alpha8node.js

[
  {
    "vendor": "parse-community",
    "product": "parse-server",
    "versions": [
      {
        "version": "< 8.6.65",
        "status": "affected"
      },
      {
        "version": ">= 9.0.0, < 9.7.0-alpha.9",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/parse-community/parse-server/security/advisories/GHSA-m983-v2ff-wq65
github	www.github.com/parse-community/parse-server/commit/776c71c3078e77d38c94937f463741793609d055
github	www.github.com/parse-community/parse-server/pull/10330
github	www.github.com/parse-community/parse-server/commit/5834e29234593addaa0251a85f572ad4f376320b
github	www.github.com/parse-community/parse-server/pull/10331

02 Apr 2026 18:11Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.3

CVSS 48.2

EPSS0.00023

SSVC

CWE-362