Prototype Pollution Vulnerability in Parse Server
CVE-2026-121965

6MEDIUM

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
4 November 2026

What is CVE-2026-121965?

The vulnerability affects Parse Server versions prior to 8.6.113 and 9.0.0 before 9.10.6-alpha.5, allowing for prototype pollution through dot notation keys when building objects for Cloud Code triggers and LiveQuery. This issue arises when an intermediate segment resolves through an inherited member, leading to the potential corruption of built-in functions. If clients with write access exploit this flaw, it could disrupt unrelated requests, causing service denial to clients and hosted applications until a server restart is performed.

Affected Version(s)

parse-server 9.0.0 < 9.10.6-alpha.5

parse-server 0 < 8.6.113

parse-server 9.10.6-alpha.5

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://github.com/parse-community/parse-server/pull/10810
patchissue-tracking
https://github.com/parse-community/parse-server/pull/10811
patchissue-tracking

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
.