https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-15T08:18:34.861252+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-parse-2026-32886 BIT-parse-2026-32886 — Parse Server's Cloud function dispatch crashes server via prototype chain traversal 2026-10-15T08:18:34.863969+00:00

Affected: Bitnami: parse

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. The fix in versions 9.6.0 and 8.6.47 restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. There is no known workaround.

 https://cve.radiocsirt.org/vuln/euvd-2026-276588 EUVD-2026-276588 2026-10-15T08:18:34.864017+00:00 EUVD-2026-276588 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32886 fkie_cve-2026-32886 2026-10-15T08:18:34.864033+00:00

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. The fix in versions 9.6.0-alpha.24 and 8.6.47 restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. There is no known workaround.

 https://cve.radiocsirt.org/vuln/ghsa-4263-jgmp-7pf4 GHSA-4263-jgmp-7pf4 — Parse Server's Cloud function dispatch crashes server via prototype chain traversal 2026-10-15T08:18:34.864057+00:00

Affected: npm: parse-server

### Impact

Remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow.

### Patches

The fix restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers.

### Workarounds

There is no known workaround.