Threats tagged 'bit-parse-2026-32886'

CVE-2026-32886 is a high-severity prototype pollution vulnerability in parse-community's parse-server versions prior to 9.6.0-alpha.24 and 8.6.47. It allows remote attackers to crash the Parse Server process by invoking a cloud function endpoint with a specially crafted function name that traverses the JavaScript prototype chain, causing a stack overflow. The vulnerability arises from improper control of object prototype attribute modification during cloud function name resolution. The fix restricts property lookups to own properties only, preventing prototype chain traversal. No known workarounds exist, and exploitation requires no authentication or user interaction.