CVE-2026-32886

EPSS 0.03%

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

發布日:2026/3/17修改日:2026/3/20

也稱為:GHSA-4263-jgmp-7pf4BIT-parse-2026-32886

描述

### Impact Remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. ### Patches The fix restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. ### Workarounds There is no known workaround.

受影響套件(2)

Bitnami/parsefrom 0, < 8.6.47, >= 9.0.0, < 9.6.0
npm/parse-server>= 9.0.0, < 9.6.0-alpha.24

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

參考連結(5)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2026-32886
PATCHhttps://github.com/parse-community/parse-server
WEBhttps://github.com/parse-community/parse-server/pull/10210
WEBhttps://github.com/parse-community/parse-server/pull/10211
WEBhttps://github.com/parse-community/parse-server/security/advisories/GHSA-4263-jgmp-7pf4