GitHub Advisoryadvisory · npm

GHSA-q3p6-g7c4-829c GraphQL API endpoint ignores CORS origin restriction

MEDIUM Published 2026-03-30 Modified 2026-03-31 Official page ↗
Aliases
CVE-2026-34373
Ecosystem
npm
Packages
parse-server
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N
Weaknesses
CWE-346
Reviewed
2026-03-30

Affected packages

• npm parse-server: >= 9.0.0, < 9.7.0-alpha.10 → fixed in 9.7.0-alpha.10 • npm parse-server: >= 3.5.0, < 8.6.66 → fixed in 8.6.66

Description

Impact The GraphQL API endpoint does not respect the `allowOrigin` server option and unconditionally allows cross-origin requests from any website. This bypasses origin restrictions that operators configure to control which websites can interact with the Parse Server API. The REST API correctly enforces the configured `allowOrigin` restriction. Patches The GraphQL API endpoint now uses the same CORS middleware as the REST API, ensuring the `allowOrigin` and `allowHeaders` server options are consistently enforced across all endpoints. Workarounds There is no known workaround other than upgrading. Resources • GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-q3p6-g7c4-829c • Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10334 • Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10335

Related

Alias · CVE (1)

  • CVE-2026-34373 Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. vulnerability

Weakness · CWE (1)

  • CWE-346 Origin Validation Error weakness

References