GraphQL API endpoint ignores CORS origin restriction

HOCH 8.8CVE-2026-34373 · BIT-parse-2026-34373 · GHSA-q3p6-g7c4-829c · Published 31/03/2026 · updated 24/07/2026

Package	Affected versions	Patched versions
parse-server parseplatform	`= 9.7.0≥ 3.5.0, < 8.6.66≥ 9.0.0, < 9.7.0`	`8.6.669.7.0`
parse-server npm	`≥ 3.5.0, < 8.6.66≥ 9.0.0, < 9.7.0-alpha.10`	`8.6.669.7.0-alpha.10`

Description

Impact

The GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction.

Patches

The GraphQL API endpoint now uses the same CORS middleware as the REST API, ensuring the allowOrigin and allowHeaders server options are consistently enforced across all endpoints.

Workarounds

There is no known workaround other than upgrading.

Resources

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c
Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10334
Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10335

NVD description

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.66 and 9.7.0-alpha.10, the GraphQL API endpoint does not respect the allowOrigin server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured allowOrigin restriction. This issue has been patched in versions 8.6.66 and 9.7.0-alpha.10.

References

parse-community/parse-server security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2026-34373 · ADVISORY
parse-community/parse-server#10334 · WEB
parse-community/parse-server#10335 · WEB
parse-community/parse-server commit 0347641 · WEB
parse-community/parse-server commit 4dd0d3d · WEB
parse-community/parse-server · PACKAGE

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

parse-server

parseplatform

= 9.7.0≥ 3.5.0, < 8.6.66≥ 9.0.0, < 9.7.0

8.6.669.7.0

parse-server

npm

≥ 3.5.0, < 8.6.66≥ 9.0.0, < 9.7.0-alpha.10

8.6.669.7.0-alpha.10

Description

Impact

Patches

The GraphQL API endpoint now uses the same CORS middleware as the REST API, ensuring the allowOrigin and allowHeaders server options are consistently enforced across all endpoints.

Workarounds

There is no known workaround other than upgrading.

Resources

GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c
Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10334
Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10335

NVD description