CVE-2026-32886
Stack Overflow in Parse Server Cloud Function Name Resolution
Publication date: 2026-03-18
Last updated on: 2026-03-19
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | From 9.0.0 (inc) to 9.6.0 (exc) |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | 9.6.0 |
| parseplatform | parse-server | to 8.6.47 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1321 | The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Parse Server, an open source backend for Node.js. Before versions 9.6.0-alpha.24 and 8.6.47, remote clients could crash the Parse Server by calling a cloud function endpoint with a specially crafted function name. This crafted name exploits the JavaScript prototype chain traversal of a registered cloud function handler, causing a stack overflow and crashing the server process.
The issue arises because the server resolves cloud function names by looking up properties along the prototype chain, which can be manipulated to cause excessive recursion. The fix restricts property lookups to own properties only, preventing prototype chain traversal and thus avoiding the stack overflow.
There is no known workaround other than upgrading to the fixed versions.
How can this vulnerability impact me? :
This vulnerability can allow remote attackers to crash the Parse Server process by sending a crafted request. This results in a denial of service (DoS) condition, making the backend unavailable to legitimate users until the server is restarted or patched.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your Parse Server to version 9.6.0-alpha.24 or later, or 8.6.47 or later. These versions include a fix that restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal and the resulting stack overflow.
There is no known workaround for this vulnerability, so upgrading is the immediate and necessary step.