Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 9.10.5-alpha.9, 8.6.108
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
Parse Server, an open-source backend framework for Node.js applications, is affected by this vulnerability. A client with write access to a class can send specially crafted field or permission names that corrupt core JavaScript object behavior on the server, causing all subsequent requests to fail until the server is restarted.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- parse-community parse-server
From 9.0.0 · fixed in 9.10.5-alpha.9
- parse-community parse-server
fixed in 8.6.108