GHSA-hpm8-9qx6-jvwv Parser Server's streaming file download bypasses afterFind file trigger authorization

• npm parse-server: >= 9.0.0, < 9.7.1-alpha.1 → fixed in 9.7.1-alpha.1 • npm parse-server: < 8.6.71 → fixed in 8.6.71

Impact File downloads via HTTP Range requests bypass the `afterFind(Parse.File)` trigger and its validators on storage adapters that support streaming (e.g. the default GridFS adapter). This allows access to files that should be protected by `afterFind` trigger authorization logic or built-in validators such as `requireUser`. Patches The streaming file download path now executes the `afterFind(Parse.File)` trigger before sending any data. Authentication is resolved from the session token header so that trigger validators can distinguish authenticated from unauthenticated requests. Workarounds Use `beforeFind(Parse.File)` instead of `afterFind(Parse.File)` for file access authorization. The `beforeFind` trigger runs on all download paths including streaming.