CVE-2026-119569 in parse-server
Summary
by MITRE • 10/30/2026
Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified security flaw resides within the Parse Server software ecosystem, specifically affecting versions prior to 8.6.108 and the 9.0.0 series before version 9.10.5-alpha.9. This vulnerability is classified as a Prototype Pollution attack, which exploits how JavaScript handles object property assignment when user-supplied input is merged into existing objects without adequate validation. In modern web application frameworks like Parse Server, data from client requests is often deserialized and assigned to internal configuration or state objects. When the code expands these inputs using methods that do not strictly check for own properties on the target object, an attacker can inject keys such as _proto_, constructor, or prototype into the request payload. Because JavaScript objects inherit properties from their prototypes by default, assigning a value to one of these special keys does not create a new property on the instance but instead modifies the global Object.prototype. This modification is persistent across all instances and requests handled by the server process until it is restarted, effectively poisoning the runtime environment for every subsequent operation.
From an operational perspective, this vulnerability leads to a severe denial of service condition rather than typical data exfiltration or remote code execution scenarios often associated with prototype pollution in other contexts. The specific impact described involves the corruption of built-in JavaScript functions that Parse Server relies upon for request processing and object manipulation. When critical methods are overwritten by attacker-controlled values, the server loses its ability to process incoming HTTP requests correctly. This results in a complete service outage where all API calls fail with errors or timeouts. For administrators relying on Parse Server for backend-as-a-service functionality, this means that user authentication, data retrieval, and write operations become entirely non-functional. The persistence of the pollution state ensures that simply handling subsequent legitimate traffic does not resolve the issue; manual intervention via server restart is required to restore normal service availability, causing significant downtime and potential loss of trust among end-users who experience abrupt service interruptions without warning or graceful degradation mechanisms.
The technical root cause aligns with CWE-1325: Incorrect Check of Buffer Boundary in Prototype Pollution, although more broadly it falls under the category of Improper Input Validation (CWE-20) specifically regarding insufficient checking for dangerous property names during object merging operations. In terms of offensive security frameworks, this attack vector is categorized under ATT&CK technique T1496: Resource Hijacking or potentially T1530: Data from Cloud Storage if the pollution leads to data leakage in other configurations, but primarily it represents a Denial of Service (T1499) via application exhaustion. The vulnerability exploits the trust placed in user-controlled keys within class write access permissions. Attackers with even basic write privileges on specific Parse classes can leverage this flaw by crafting requests that include dot-notation field names or Access Control List entry names designed to match internal object prototypes. This highlights a critical design oversight where input sanitization is not applied at the point of deserialization for all potential property paths, allowing malicious payloads to bypass standard validation layers and reach the core object assignment logic.
Mitigation strategies must focus on immediate patching and architectural hardening. The primary remediation step is to upgrade Parse Server to version 8.6.108 or later, or if using the 9.x branch, to version 9.10.5-alpha.9 or any subsequent stable release where this prototype pollution vector has been addressed through stricter input validation and object assignment safeguards. For organizations unable to patch immediately due to dependency constraints, temporary mitigations include implementing a Web Application Firewall rule that inspects incoming JSON payloads for suspicious keys such as _proto_, constructor, or prototype within nested objects associated with write operations. Additionally, developers should enforce strict schema validations on the server side that reject any field names containing dot notation unless explicitly whitelisted and sanitized. It is also advisable to review Access Control List configurations to ensure that permissions are granted only to necessary classes and users, thereby reducing the attack surface available to potential adversaries seeking to exploit this specific deserialization flaw. Regular security audits focusing on object manipulation patterns in JavaScript-based backends can further prevent similar vulnerabilities from being introduced during future development cycles.