CVE-2026-32886: Parse Server's Cloud function dispatch crashes server via prototype chain traversal
Impact
Remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow.
Patches
The fix restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers.
Workarounds
There is no known workaround.
Other sources
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. The fix in versions 9.6.0-alpha.24 and 8.6.47 restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. There is no known workaround.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-32886?
CVE-2026-32886 is a critical vulnerability that can lead to server crashes.
How do I fix CVE-2026-32886?
To fix CVE-2026-32886, upgrade to Parse Server version 8.6.47 or 9.6.0-alpha.24 or later.
What types of systems are affected by CVE-2026-32886?
CVE-2026-32886 affects systems using specific versions of Parse Server running on Node.js.
What is the impact of CVE-2026-32886 on applications?
CVE-2026-32886 allows remote clients to crash the Parse Server process by exploiting cloud function endpoints.
Are there any workarounds for CVE-2026-32886 until a fix is applied?
Currently, the best workaround for CVE-2026-32886 is to restrict access to cloud function endpoints.