Is there a patch available for EUVD-2026-17504?

Yes, a patch is available for EUVD-2026-17504. Update the affected software to the latest version immediately.

Node.js EUVD-2026-17504

Q: What is the CVSS score of EUVD-2026-17504?

EUVD-2026-17504 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-34595 MEDIUM

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2026-03-31 GitHub_M

GHSA-mmg8-87c5-jrc2

Authentication Bypass Memory Corruption Node.js Oracle Parse Server Parse Community

5.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (GitHub_M) · only source for this CVE.

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Apr 01, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 15:31 euvd

EUVD-2026-17504

Analysis Generated

Mar 31, 2026 - 15:31 vuln.today

CVE Published

Mar 31, 2026 - 15:10 nvd

MEDIUM 5.3

DescriptionCVE.org

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to versions 8.6.70 and 9.7.0-alpha.18, an authenticated user with find class-level permission can bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By sending a subscription with a $or, $and, or $nor operator value as a plain object with numeric keys and a length property (an "array-like" object) instead of an array, the protected-field guard is bypassed. The subscription event firing acts as a binary oracle, allowing the attacker to infer whether a protected field matches a given test value. This issue has been patched in versions 8.6.70 and 9.7.0-alpha.18.

AnalysisAI

Parse Server versions prior to 8.6.70 and 9.7.0-alpha.18 allow authenticated users with find class-level permissions to bypass protectedFields restrictions on LiveQuery subscriptions by submitting array-like objects with numeric keys instead of proper arrays in $or, $and, or $nor operators. This enables information disclosure through a binary oracle attack that reveals whether protected fields match attacker-supplied values. The vulnerability requires prior authentication and find-level access but no user interaction, affecting all deployments of vulnerable Parse Server versions.

Technical ContextAI

Parse Server is a Node.js-based backend framework that implements MongoDB query language operators for data filtering. The vulnerability exploits improper type validation in the LiveQuery subscription handler for the $or, $and, and $nor operators. When the server processes subscription queries, it expects these operators to contain arrays, but fails to strictly validate array types. By sending array-like objects (plain objects with numeric keys 0, 1, 2... and a length property), attackers circumvent the protectedFields access control logic that normally blocks queries on sensitive fields. The root cause is a type-checking bypass (CWE-843: Access of Resource Using Incompatible Type) where the guard logic does not properly validate the data structure before processing query conditions. LiveQuery subscriptions remain active and fire events when matching records are modified, making the subscription response itself an information leak channel. Affected product: cpe:2.3:a:parse-community:parse-server:*:*:*:*:*:*:*:* (all versions before patched releases).

RemediationAI

Upgrade Parse Server to version 8.6.70 or later (8.x branch) or 9.7.0-alpha.18 or later (9.x branch). These versions include input validation fixes in pull requests https://github.com/parse-community/parse-server/pull/10350 and https://github.com/parse-community/parse-server/pull/10351 that properly validate array structure for $or, $and, and $nor operators in LiveQuery subscriptions, ensuring array-like objects are rejected. The upstream fixes are committed at https://github.com/parse-community/parse-server/commit/f63fd1a3fe0a7c1c5fe809f01b0e04759e8c9b98 and https://github.com/parse-community/parse-server/commit/ffad0ec6b971ee0dd9545e1bf1fb34ddebf275c2. Users unable to immediately upgrade should review LiveQuery subscription permissions and limit find-level class access to trusted applications only, though this does not eliminate the vulnerability.