CVE-2026-121965

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.113 Parse Server versions 9.0.0 through 9.10.6-alpha.4

Description Prototype pollution occurs when building objects for Cloud Code triggers and LiveQuery. This happens when a dot notation key with an intermediate segment that resolves through an inherited member writes to a process-wide built-in. An attacker with write access to an object in a class associated with a trigger or LiveQuery can corrupt a built-in function. This corruption causes unrelated requests to fail and results in a denial of service for all clients and hosted applications until the process is restarted.

Recommendations Update Parse Server to version 8.6.113 or later. Update Parse Server to version 9.10.6-alpha.5 or later.