CVE-2026-121965— Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

Quick assessment

Affected

parse-community parse-server

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 8.6.113 之前的 Parse Server，以及 9.0.0 至 9.10.6-alpha.5 之前的版本中，存在一个原型污染漏洞。该漏洞发生在为 Cloud Code 触发器和 LiveQuery 构建对象时：当使用点表示法（dot notation）的键，且其中间段通过继承成员解析时，攻击者可向进程级别的内建对象写入数据。任何拥有对包含触发器或 LiveQuery 的类中对象写入权限的客户端，均可污染内建函数，导致不相关的请求失败，直至服务重启，从而对所有客户端及托管应用造成拒绝服务（DoS）。

CVSS 5.3 · Medium Updated Nov 05, 2026

Possible ATT&CK Techniques 3 AI

T1068 · Exploitation for Privilege Escalation T1499 · Endpoint Denial of Service T1190 · Exploit Public-Facing Application

Affected Version Matrix 4

Vendor	Product	Version Range	Status
parse-community	parse-server	`9.0.0< 9.10.6-alpha.5`	affected
		`9.10.6-alpha.5`	unaffected
		`< 8.6.113`	affected
		`8.6.113`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key

Source: CVE Program / CVE List V5

Vulnerability Description

Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clients with write access to an object in a class with a trigger or LiveQuery can corrupt a built-in function, making unrelated requests fail until restart and denying service to all clients and hosted applications.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1321

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
parse-community	parse-server	9.0.0 ~ 9.10.6-alpha.5	-
parse-community	parse-server	0 ~ 8.6.113	-

II. Public POCs for CVE-2026-121965

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121965

请登录查看更多情报信息。

Other References for CVE-2026-121965 (4)

https://github.com/parse-community/parse-server/pull/10810 patch issue-tracking
https://github.com/parse-community/parse-server/pull/10811 patch issue-tracking
https://github.com/parse-community/parse-server/security/advisories/GHSA-95hp-82c6-25q5 vendor-advisory
https://www.vulncheck.com/advisories/parse-server-before-8.6.113-and-9.10.6-alpha.5-prototype-pollution-via-dot-notation-key third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121965

IV. Related Vulnerabilities

Same product: parse-server

Same vendor: parse-community

Same weakness: CWE-1321