PT-2026-25986 · Npm · Parse Server

Published 2026-03-17 · Updated 2026-03-17 · CVE-2026-32886

OSV

CVSS v4.0

8.2

8.2

High

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Impact

Remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow.

Patches

The fix restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers.

Workarounds

There is no known workaround.

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2026-32886

GHSA-4263-JGMP-7PF4

Affected Products

Parse Server

References · 5

• https://osv.dev/vulnerability/GHSA-4263-jgmp-7pf4 · Vendor Advisory
• https://github.com/parse-community/parse-server · Note
• https://github.com/parse-community/parse-server/pull/10210 · Note
• https://github.com/parse-community/parse-server/pull/10211 · Note
• https://github.com/parse-community/parse-server/security/advisories/GHSA-4263-jgmp-7pf4 · Note