CVE-2026-119569

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.108 Parse Server versions 9.0.0 through 9.10.5-alpha.8

Description Prototype pollution occurs because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names that match built-in object members to corrupt built-in functions. This can lead to a denial of service where all requests fail until the server is restarted.

Recommendations Update Parse Server to version 8.6.108 or later. Update Parse Server to version 9.10.5-alpha.9 or later.