CVE-2026-34595: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34595 is a type confusion vulnerability in Parse Server (an open source Node.js backend) that allows an authenticated user with find class-level permission to bypass the protectedFields class-level permission setting on LiveQuery subscriptions. By supplying a $or, $and, or $nor operator value as a plain object with numeric keys and a length property (an "array-like" object) instead of a proper JavaScript array, the protected-field guard is circumvented. The vulnerability affects all Parse Server versions prior to 8.6.70 (8.x branch) and versions 9.0.0 through 9.7.0-alpha.15 (9.x branch). It was disclosed on March 31, 2026, with patches released the same day. The CVSS v3.1 base score is 4.3 (Medium) and the CVSS v4.0 base score is 5.3 (Medium) (GitHub Advisory).

The root cause is a type confusion flaw (CWE-843: Access of Resource Using Incompatible Type) in Parse Server's LiveQuery subscription handler, query depth checker, and protected-field guard (denyProtectedFields in RestQuery.js, _validateQueryConstraints in ParseLiveQueryServer.ts, and matchesKeyConstraints in QueryTools.js). These components iterate over $or, $and, and $nor operator values assuming they are JavaScript arrays, but do not explicitly validate the type before processing. An attacker can craft a subscription query where the operator value is a plain object with numeric keys (e.g., {"0": {...}, "length": 1}) — an "array-like" object — which passes the guard's iteration logic without triggering the protected-field check. The subscription event then fires as a binary oracle: the attacker observes whether a LiveQuery event is emitted to infer whether a protected field matches a supplied test value, enabling iterative extraction of sensitive data (GitHub Advisory, PR #10350).

Successful exploitation allows an authenticated attacker to infer the values of fields that are explicitly protected by the protectedFields class-level permission — data that should be inaccessible to the attacker's role. By repeatedly querying with different test values and observing whether a LiveQuery subscription event fires, the attacker can reconstruct the contents of protected fields (e.g., sensitive user attributes, secrets, or internal identifiers) through a binary oracle side-channel. The impact is limited to confidentiality (no integrity or availability impact), and exploitation requires a valid authenticated session with find permission on the target class (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure (Feedly). The vulnerability requires authentication and find class-level permission, which limits the attacker pool. The EPSS score is approximately 0.045% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was reported by researcher "bugbunny-research" and coordinated by maintainer mtrezza (GitHub Advisory).

1. Authenticate: Obtain valid credentials for a Parse Server account that has find class-level permission on a class with protectedFields configured.
2. Establish LiveQuery connection: Connect to the Parse Server LiveQuery WebSocket endpoint (typically wss://<host>/1/events).
3. Craft malicious subscription: Instead of supplying a standard array for a $or, $and, or $nor operator, construct a plain JavaScript object with numeric keys and a length property mimicking an array (e.g., { "$or": { "0": { "secretField": "<test_value>" }, "length": 1 } }).
4. Send subscription: Submit the crafted subscription query to the LiveQuery server. The protected-field guard iterates over the object as if it were an array, bypassing the field restriction check.
5. Observe oracle response: Monitor whether a LiveQuery subscription event fires when a matching object is updated. If the event fires, the protected field matches the test value; if not, it does not match.
6. Iterate to extract data: Repeat step 3–5 with different test values (e.g., binary search or character-by-character enumeration) to reconstruct the full value of the protected field (GitHub Advisory, PR #10350).

• Network: Unusual or repeated LiveQuery WebSocket subscription messages containing $or, $and, or $nor operator values that are plain objects (with numeric keys and a length property) rather than JSON arrays; high-frequency subscription/unsubscription cycles from a single authenticated client targeting the same class.
• Logs: Parse Server logs showing repeated LiveQuery subscription events from the same session or user ID against a class with protectedFields configured; subscription queries with malformed operator structures logged at the WebSocket handler level.
• Application Behavior: A single authenticated user generating an unusually large number of LiveQuery subscription events in a short time window, particularly with slight variations in query conditions targeting the same field.

Upgrade Parse Server to version 8.6.70 (for the 8.x LTS branch) or 9.7.0 / 9.7.0-alpha.16 or later (for the 9.x branch). The fix validates that $or, $and, and $nor operator values are proper JavaScript arrays in the LiveQuery subscription handler (ParseLiveQueryServer.ts), the query depth checker (QueryTools.js), and the protected-field guard (RestQuery.js); as defense in depth, the LiveQuery query evaluator also rejects non-array values with Parse.Error.INVALID_QUERY. There is no known workaround — patching is the only remediation. As an interim measure, consider restricting LiveQuery subscription permissions where possible and auditing protectedFields configurations (GitHub Advisory, PR #10350, PR #10351).

The vulnerability was reported by researcher "bugbunny-research" and coordinated by Parse Server maintainer mtrezza, who published the GitHub Security Advisory (GHSA-mmg8-87c5-jrc2) and merged fixes for both the 8.x and 9.x branches on March 29, 2026. No significant broader media coverage or notable community commentary beyond the GitHub advisory and pull request discussions has been observed (GitHub Advisory).