Live › vulnerability › CVE-2026-119569
Parse Server expands user-supplied field keys and ACL entry names into objects without own-property checks, so crafted keys can overwrite built-in object members. A client with class write access can corrupt built-in functions, causing all requests to fail until the server restarts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 14:30 UTC. All times on this page are UTC.
Teams running Parse Server 8.x before 8.6.108 or 9.x before 9.10.5-alpha.9 are exposed. Exploitation needs a client with class write access, so apps where only trusted server code writes data are lower risk. Deployments that can skip it are those already on the fixed versions.
No product ranges from the sources yet.
npm ls parse-server or the version in package.json.8.6.108 or later.9.10.5-alpha.9 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.
This page as .md · .json · in your agent: get_signal("CVE-2026-119569")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.