Executive brief
Parse Server is a backend framework that handles cloud functions—custom server-side code invoked by client applications. An attacker can crash the entire server by sending a specially crafted cloud function request with a function name that exploits how JavaScript prototype chains are handled, rendering the service unavailable to all users. This attack requires no authentication and can be executed remotely over the network.
Technical details
The vulnerability exists in Parse Server's Cloud function name resolution logic, which improperly traverses the JavaScript prototype chain when looking up registered cloud function handlers. An attacker can provide a crafted function name that exploits prototype chain traversal (CWE-1321) to cause a stack overflow, crashing the server process. The attack vector is network-based with low attack complexity and no authentication requirement. The fix restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. Patches are available in versions 8.6.47 and 9.6.0-alpha.24 and later.
Affected products
- Parse Community Parse Server Versions 0 through 8.6.46; versions 9.0.0 through 9.6.0-alpha.23. Fixed in 8.6.47, 9.6.0-alpha.24, and later.
Timeline
- 2026-03-17: disclosed: Advisory published
- 2026-03-15: patched: Fixes merged for v9 (PR #10210) and v8 (PR #10211)