CVE-2026-30939

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-30939
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the function name. The server recurses infinitely, causing a call stack size error that terminates the process. Other prototype property names bypass Cloud Function dispatch validation and return HTTP 200 responses, even though no such Cloud Functions are defined. The same applies to dot-notation traversal. All Parse Server deployments that expose the Cloud Function endpoint are affected. This vulnerability is fixed in 8.6.13 and 9.5.1-alpha.2.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/parse-community/parse-server/releases/tag/8.6.13 Product Release Notes
https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.2 Product Release Notes
https://github.com/parse-community/parse-server/security/advisories/GHSA-5j86-7r7m-p8h6 Mitigation Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.1:alpha1:*:*:*:node.js:*:*
History

11 Mar 2026, 19:51

Type Values Removed Values Added
CPE cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:node.js:*:*
cpe:2.3:a:parseplatform:parse-server:9.5.1:alpha1:*:*:*:node.js:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5
References () https://github.com/parse-community/parse-server/releases/tag/8.6.13 - () https://github.com/parse-community/parse-server/releases/tag/8.6.13 - Product, Release Notes
References () https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.2 - () https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.2 - Product, Release Notes
References () https://github.com/parse-community/parse-server/security/advisories/GHSA-5j86-7r7m-p8h6 - () https://github.com/parse-community/parse-server/security/advisories/GHSA-5j86-7r7m-p8h6 - Mitigation, Patch, Vendor Advisory
First Time Parseplatform
Parseplatform parse-server

11 Mar 2026, 13:53

Type Values Removed Values Added
Summary
  • (es) Parse Server es un backend de código abierto que puede ser desplegado en cualquier infraestructura que pueda ejecutar Node.js. Antes de 8.6.13 y 9.5.1-alpha.2, un atacante no autenticado puede bloquear el proceso de Parse Server al llamar a un endpoint de función en la nube con un nombre de propiedad de prototipo como nombre de la función. El servidor entra en recursión infinita, causando un error de tamaño de pila de llamadas que termina el proceso. Otros nombres de propiedades de prototipo eluden la validación de despacho de funciones en la nube y devuelven respuestas HTTP 200, aunque no haya funciones en la nube definidas. Lo mismo se aplica al recorrido por notación de puntos. Todas las implementaciones de Parse Server que exponen el endpoint de función en la nube se ven afectadas. Esta vulnerabilidad está corregida en 8.6.13 y 9.5.1-alpha.2.

10 Mar 2026, 18:18

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-10 18:18

Updated : 2026-03-11 19:51

NVD link : CVE-2026-30939

Mitre link : CVE-2026-30939

CVE.ORG link : CVE-2026-30939

JSON object : View

Products Affected

parseplatform

  • parse-server
CWE
CWE-1321

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')