CVE-2026-32886 Details
Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. The fix in versions 9.6.0-alpha.24 and 8.6.47 restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. There is no known workaround.
A denial-of-service vulnerability has been identified in Parse Server, an open-source backend framework that runs on Node.js. This issue affects versions 9.0.0 prior to 9.6.0-alpha.24 and versions prior to 8.6.47. The vulnerability arises when remote clients call a cloud function endpoint with a specially crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler. This traversal can lead to a stack overflow, crashing the Parse Server process. The vulnerability has been patched in versions 9.6.0-alpha.24 and 8.6.47 by restricting property lookups during cloud function name resolution to only include own properties, thereby preventing prototype chain traversal from stored function handlers.
Users can upgrade to Parse Server versions 9.6.0-alpha.24 or 8.6.47 to address this vulnerability. Instructions for upgrading can be found in the Parse Server documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/parse-community/parse-server/pull/10210 | [email protected] | Issue Tracking |
| https://github.com/parse-community/parse-server/pull/10211 | [email protected] | Issue Tracking |
| https://github.com/parse-community/parse-server/security/advisories/GHSA-4263-jgmp-7pf4 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| parseplatform parse-server | < 8.6.47 >= 9.0.0, < 9.6.0 9.6.0 alpha1 9.6.0 alpha10 9.6.0 alpha11 9.6.0 alpha12 9.6.0 alpha13 9.6.0 alpha14 9.6.0 alpha15 9.6.0 alpha16 9.6.0 alpha17 9.6.0 alpha18 9.6.0 alpha19 9.6.0 alpha2 9.6.0 alpha20 9.6.0 alpha21 9.6.0 alpha22 9.6.0 alpha23 9.6.0 alpha3 9.6.0 alpha4 9.6.0 alpha5 9.6.0 alpha6 9.6.0 alpha7 9.6.0 alpha8 9.6.0 alpha9 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 19, 2026 | Initial Analysis | [email protected] |
| Mar 18, 2026 | New CVE Received | [email protected] |