CVE-2026-34784

Description

### Impact File downloads via HTTP Range requests bypass the `afterFind(Parse.File)` trigger and its validators on storage adapters that support streaming (e.g. the default GridFS adapter). This allows access to files that should be protected by `afterFind` trigger authorization logic or built-in validators such as `requireUser`. ### Patches The streaming file download path now executes the `afterFind(Parse.File)` trigger before sending any data. Authentication is resolved from the session token header so that trigger validators can distinguish authenticated from unauthenticated requests. ### Workarounds Use `beforeFind(Parse.File)` instead of `afterFind(Parse.File)` for file access authorization. The `beforeFind` trigger runs on all download paths including streaming.

How to fix CVE-2026-34784

To remediate CVE-2026-34784, upgrade the affected package to a fixed version below.

• —upgrade to 8.6.71 or later
• —upgrade to 9.7.1-alpha.1 or later

Is CVE-2026-34784 being exploited?

Low — EPSS is 0.0%, meaning exploitation activity has not been observed at scale.

Affected packages (2)

• from 0, < 8.6.71, >= 9.0.0, < 9.7.1
• >= 9.0.0, < 9.7.1-alpha.1

CVSS scores

References (7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-34784
• PATCHgithub.com/parse-community/parse-server
• WEBgithub.com/parse-community/parse-server/commit/053109b3ee71815bc39ed84116c108ff9edbf337
• WEBgithub.com/parse-community/parse-server/commit/a0b0c69fc44f87f80d793d257344e7dcbf676e22