CVE-2026-119569— Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service

Quick assessment

Affected

parse-community parse-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Parse Server 8.6.108 之前的版本，以及 9.0.0 至 9.10.5-alpha.9 之前的版本中，存在原型污染漏洞。该漏洞源于系统将用户可控的键名直接扩展至对象中，而未执行自有属性（own-property）检查。拥有类写入权限的客户端可以发送以点号表示法（dot notation）编写的字段键名，或匹配内置对象成员的 ACL 条目名称，从而污染内置函数。这会导致所有请求失败，直至服务器重启。

CVSS 5.3 · Medium Updated Oct 31, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1203 · Exploitation for Client Execution

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Parse Server 9.0.0 before 9.10.5-alpha.9 Prototype Pollution Denial of Service

Source: CVE Program / CVE List V5

Vulnerability Description

Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because user-controlled keys are expanded into objects without own-property checks. Clients with class write access can send dot notation field keys or ACL entry names matching built-in object members to corrupt built-in functions, causing all requests to fail until server restart.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1321

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
parse-community	parse-server	9.0.0 ~ 9.10.5-alpha.9	-
parse-community	parse-server	0 ~ 8.6.108	-

II. Public POCs for CVE-2026-119569

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119569

请登录查看更多情报信息。

Other References for CVE-2026-119569 (2)

https://github.com/parse-community/parse-server/security/advisories/GHSA-rx55-fw4j-pvpx vendor-advisory
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.5-alpha.9-prototype-pollution-denial-of-service third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119569

Same Patch Batch · parse-community · 2026-10-30 · 3 CVEs total

CVE-2026-119571	3.7 LOW	Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installatio
CVE-2026-119570	3.1 LOW	Parse Server 9.7.0 before 9.10.5-alpha.7 Protected Field Exposure in Save Responses

IV. Related Vulnerabilities

Same product: parse-server

Same vendor: parse-community

Same weakness: CWE-1321