CVE-2026-121965 in Parse Server
Summary
by MITRE • 11/04/2026
Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clients with write access to an object in a class with a trigger or LiveQuery can corrupt a built-in function, making unrelated requests fail until restart and denying service to all clients and hosted applications.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
Parse Server versions prior to 8.6.113 and the 9.0.0 series before version 9.10.6-alpha.5 are susceptible to a critical prototype pollution vulnerability that arises during the processing of Cloud Code triggers and LiveQuery events. This flaw is rooted in how the server constructs objects for these asynchronous operations, specifically when handling keys defined using dot notation. The core technical deficiency lies in the object merging logic which fails to properly distinguish between an object's own properties and those inherited from its prototype chain. When a client submits data containing a key with intermediate segments that resolve through an inherited member rather than existing as direct properties on the target object, the server incorrectly writes this value onto the global Object.prototype or similar process-wide built-in structures instead of isolating it within the specific instance being processed.
The operational impact of this vulnerability is severe and directly affects service availability for all users connected to the Parse Server instance. Because the pollution occurs at a process-wide level rather than an isolated session level, any client possessing write access to an object in a class configured with Cloud Code triggers or LiveQuery can exploit this flaw. By carefully crafting requests that leverage dot notation keys targeting inherited properties such as toString, valueOf, or hasOwnProperty, attackers can overwrite these fundamental JavaScript methods on the global prototype chain. This corruption causes subsequent unrelated requests across all active sessions to fail unpredictably, effectively resulting in a denial of service condition for every client and hosted application relying on the server until the process is restarted by an administrator.
From a classification perspective, this vulnerability aligns with CWE-1325, which describes Incorrectly Controlled Modification of Object Prototype Attributes, often referred to as prototype pollution. The attack vector allows remote unauthenticated or low-privilege authenticated users to manipulate the execution environment without needing direct access to server-side code. In terms of offensive security frameworks, this behavior maps closely to MITRE ATT&CK technique T1556, specifically sub-technique T1556.003 for Modifying Cloud Compute Infrastructure or general lateral movement via credential and configuration manipulation if the pollution leads to privilege escalation in broader contexts. However, in this specific instance, the primary outcome is service disruption rather than data exfiltration or persistent backdoor installation, although the potential for further exploitation exists depending on how other parts of the application stack interact with polluted prototypes.
Mitigation strategies must prioritize immediate patching as the most effective defense. Administrators should upgrade Parse Server to version 8.6.113 or later in the 8.x branch, or version 9.10.6-alpha.5 and above for those on the development track of the 9.x series where this logic has been corrected. Until patching is feasible, defensive coding practices within custom Cloud Code functions should be implemented to sanitize input data strictly before it reaches internal object construction methods. This includes validating that keys do not contain dot notation sequences that could traverse prototype chains and ensuring that any dynamic property assignment uses safe merging techniques such as Object.assign with a null prototype or deep cloning libraries that explicitly ignore inherited properties. Additionally, enabling strict mode in JavaScript execution environments can help mitigate some side effects of accidental global variable creation, though it does not fully prevent prototype pollution attacks targeting existing built-in methods.