Executive brief
Parse Server is a backend-as-a-service platform that allows developers to run cloud functions (custom business logic) on the server. An unauthenticated attacker can crash the entire Parse Server instance by making a specially crafted request to the Cloud Function endpoint using prototype property names like "constructor" or "toString". Additionally, attackers can bypass validation checks to invoke non-existent functions and receive misleading success responses, potentially circumventing security controls or masking malicious activity.
Technical details
This vulnerability stems from improper handling of prototype chain properties in the Cloud Function, Jobs, Triggers, and Validators handler registries. When the server resolves function names via property lookup, it fails to filter out prototype chain properties like "constructor", "toString", and "hasOwnProperty". An attacker exploiting the DoS vector sends a request to the Cloud Function endpoint with a prototype property name as the function name, triggering infinite recursion during property resolution that exhausts the call stack and crashes the process. Other prototype properties bypass the dispatcher validation logic entirely, returning HTTP 200 responses even though no Cloud Functions are defined with those names. The vulnerability is unauthenticated (PR:N), network-accessible (AV:N), and requires no special conditions (AC:L, AT:N, UI:N). Patches change the internal registries to explicitly exclude prototype chain properties from resolution. Affected versions are all Parse Server releases prior to 8.6.13 and 9.0.0-alpha.1 through 9.5.1-alpha.2.
Affected products
- Parse Community Parse Server < 8.6.13, >= 9.0.0-alpha.1 < 9.5.1-alpha.2
Timeline
- 2026-03-10: disclosed: GHSA-5j86-7r7m-p8h6 published on OSV database
- 2026-03-07: patched: Patches released: Parse Server 8.6.13 and 9.5.1-alpha.2