PT-2026-24188 · Unknown · Parse Server

Theinfosecguy · Published 2026-03-10 · Updated 2026-03-18 · CVE-2026-30939

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.13 Parse Server versions prior to 9.5.1-alpha.2

Description An unauthenticated attacker can cause a denial of service by crashing the Parse Server process. This occurs by calling a Cloud Function endpoint with a prototype property name as the function name, leading to infinite recursion and a call stack size error. Additionally, prototype property names bypass Cloud Function dispatch validation, resulting in HTTP 200 responses even when no corresponding Cloud Functions are defined. This also applies to dot-notation traversal. The vulnerability affects all Parse Server deployments exposing the Cloud Function endpoint. The issue involves the internal handler registries for Cloud Functions, Jobs, Triggers, and Validators, which previously allowed prototype chain properties to be resolved.

Recommendations Versions prior to 8.6.13 should be updated to version 8.6.13. Versions prior to 9.5.1-alpha.2 should be updated to version 9.5.1-alpha.2. As a temporary workaround, consider placing a reverse proxy or Web Application Firewall (WAF) in front of Parse Server and blocking requests to Object.prototype property names.

Exploit

Fix

DoS

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

BIT-PARSE-2026-30939

CVE-2026-30939

GHSA-5J86-7R7M-P8H6

Affected Products

Parse Server

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30939.json · Exploit
• https://github.com/parse-community/parse-server/security/advisories/GHSA-5j86-7r7m-p8h6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-parse-2026-30939 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5j86-7r7m-p8h6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-30939 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-30939 · Security Note
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/releases/tag/8.6.13 · Note
• https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.2 · Note
• https://twitter.com/CVEnew/status/2034136485515952253 · Twitter Post
• https://twitter.com/infoflowcloud/status/2034138079049457924 · Twitter Post
• https://t.me/cveNotify/155167 · Telegram Post
• https://twitter.com/dailycve/status/2034294840414863831 · Twitter Post