Description
Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.
Published: 2026-10-30
Score: 6 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Description Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.
Title Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service
First Time appeared Parseplatform
Parseplatform parse-server
Weaknesses CWE-1321
CPEs cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:*
Vendors & Products Parseplatform
Parseplatform parse-server
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Parseplatform Parse-server
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-30T15:53:54.963Z

Reserved: 2026-10-30T10:56:15.488Z

Link: CVE-2026-119569

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-30T14:16:45.497

Modified: 2026-10-30T14:16:45.650

Link: CVE-2026-119569

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T14:30:08Z

Weaknesses
  • CWE-1321

    Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')