PT-2026-25986 · Unknown · Parse Server

Fancymalware · Publicado 2026-03-17 · Atualizado 2026-03-20 · CVE-2026-32886

Positive Technologies (AI Summary)

CVSS v4.0

8.2

Alta

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 9.6.0-alpha.24 Parse Server versions prior to 8.6.47

Description Remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name. This crafted name traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. The issue affects Parse Server, an open source backend deployable on Node.js infrastructures. The fix restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. The vulnerable component is the cloud function handler. The attack is performed by calling a cloud function endpoint with a crafted function name.

Recommendations Update Parse Server to version 9.6.0-alpha.24 or later. Update Parse Server to version 8.6.47 or later.

Exploit

Correção

DoS

Prototype Pollution

Enumeração de Fraquezas

CWE-1321

Identificadores relacionados

BIT-PARSE-2026-32886

CVE-2026-32886

GHSA-4263-JGMP-7PF4

Produtos afetados

Parse Server

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32886.json · Exploit
• https://github.com/parse-community/parse-server/pull/10211 · Nota
• https://github.com/parse-community/parse-server/security/advisories/GHSA-4263-jgmp-7pf4 · Aviso do Fabricante
• https://github.com/parse-community/parse-server/pull/10210 · Nota
• https://github.com/parse-community/parse-server · Nota
• https://osv.dev/vulnerability/CVE-2026-32886 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/2034419207593509265 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-4263-jgmp-7pf4 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2034520416216109325 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-32886 · Nota de Segurança
• https://osv.dev/vulnerability/BIT-parse-2026-32886 · Aviso do Fabricante
• https://twitter.com/RedPacketSec/status/2034735869672714590 · Publicação no Twitter