8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-30939

CVE-2026-30939: Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the function name. The server recurses infinitely, causing a call stack size error that terminates the process. Other prototype property names bypass Cloud Function dispatch validation and return HTTP 200 responses, even though no such Cloud Functions are defined. The same applies to dot-notation traversal. All Parse Server deployments that expose the Cloud Function endpoint are affected. This vulnerability is fixed in 8.6.13 and 9.5.1-alpha.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-30939

CVE-2026-30939:

8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	< 8.6.13	8.6.13
parse-server	npm	>= 9.0.0-alpha.1, < 9.5.1-alpha.2	9.5.1-alpha.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the way Parse Server handles Cloud Function dispatch. An attacker could use property names from Object.prototype (like 'toString' or 'constructor') as the name of a Cloud Function in a request. The server's internal handler registry, which was a standard JavaScript object ({}), would resolve these names to the corresponding properties on the object's prototype chain. This could lead to a Denial of Service (DoS) through infinite recursion or allow an attacker to bypass Cloud Function dispatch validation.

The patch addresses this vulnerability by changing the initialization of the handler registries for Cloud Functions, Jobs, Triggers, and Validators. Instead of using {}, the patch introduces a createStore function that returns a prototype-free object created with Object.create(null). This ensures that when looking up a function by name, only explicitly defined handlers are found, and the prototype chain is not traversed. The getStore function, which is responsible for looking up handlers in these stores, is the key location where the vulnerable lookup occurs. The modification to how the stores are created directly mitigates the vulnerability within getStore.

Vulnerable functions

getStore

src/triggers.js

The `getStore` function is used to retrieve cloud functions, jobs, and triggers from a store. The stores were initialized as plain JavaScript objects (`{}`), which have a prototype. When a user-provided function name (e.g., 'toString', 'constructor') is passed to `getStore`, the lookup `store[component]` could resolve to a property on `Object.prototype`. This allowed an attacker to access built-in Object properties, leading to infinite recursion and a Denial of Service, or bypassing dispatch validation. The patch fixes this by creating prototype-free objects using `Object.create(null)` for the stores.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.