8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32886

CVE-2026-32886: Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. The fix in versions 9.6.0-alpha.24 and 8.6.47 restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. There is no known workaround.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32886

CVE-2026-32886:

8.2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
parse-server	npm	>= 9.0.0, < 9.6.0-alpha.24	9.6.0-alpha.24
parse-server	npm	< 8.6.47	8.6.47

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the parse-server's cloud function dispatch mechanism, specifically within the src/triggers.js file. The functions getStore and get are responsible for resolving and retrieving cloud functions. The core of the vulnerability is that these functions used user-provided function names to traverse an internal object (_triggerStore) without validating that each part of the function name path was an 'own' property of the object. This allowed an attacker to craft a function name including properties like __proto__ or constructor, causing the code to traverse the JavaScript prototype chain. This prototype chain traversal could lead to a stack overflow, crashing the server. The provided patches fix this by adding Object.prototype.hasOwnProperty.call() checks in both getStore and get functions. This ensures that only the object's own properties are accessed, effectively preventing the prototype chain traversal and mitigating the denial-of-service vulnerability.

Vulnerable functions

getStore

src/triggers.js

The `getStore` function is vulnerable to prototype chain traversal. It iterates through path components derived from the function name and accesses properties on the `store` object without checking if they are own properties. An attacker can craft a function name with `__proto__` or `constructor` to traverse the prototype chain, leading to a stack overflow and server crash. The patch adds `Object.prototype.hasOwnProperty.call(store, component)` to prevent this.

get

src/triggers.js

The `get` function is vulnerable as it retrieves a function from the `store` using `lastComponent` of the function name without verifying if it's an own property. This allows an attacker to access inherited properties via prototype chain traversal by crafting a malicious function name, which can lead to a server crash. The patch introduces `Object.prototype.hasOwnProperty.call(store, lastComponent)` to fix this.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.