Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via HTTP Range requests bypass the afterFind(Parse.File) trigger and its validators on storage adapters that support streaming (e.g. the default GridFS adapter). This allows access to files that should be protected by afterFind trigger authorization logic or built-in validators such as requireUser. This issue has been patched in versions 8.6.71 and 9.7.1-alpha.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-34784 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via… https://www.cve.org/CVERecord?id=CVE-2026-34784
Post summary
A brief disclosure of CVE‑2026‑34784 indicating a file‑download issue in older Parse Server releases, with no PoC, exploit, or patch details provided.
🚨*CVE* CVE-2026-34784 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.71 and 9.7.1-alpha.1, file downloads via… https://www.cve.org/CVERecord?id=CVE-2026-34784 ----- Traducción: CVE-2026-34784 Par… http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑34784 affecting Parse Server before specific Node.js versions, linking to a CVE record, but provides no exploit, patch, or real‑world usage information.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | parseplatform | parse-server | - | node.js | - |