CVE-2026-30939

Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 8.6.13 and 9.5.1-alpha.2, an unauthenticated attacker can crash the Parse Server process by calling a Cloud Function endpoint with a prototype property name as the function name. The server recurses infinitely, causing a call stack size error that terminates the process. Other prototype property names bypass Cloud Function dispatch validation and return HTTP 200 responses, even though no such Cloud Functions are defined. The same applies to dot-notation traversal. All Parse Server deployments that expose the Cloud Function endpoint are affected. This vulnerability is fixed in 8.6.13 and 9.5.1-alpha.2.

• CWE-1321

• https://github.com/parse-community/parse-server/releases/tag/8.6.13Product, Release Notes
• https://github.com/parse-community/parse-server/releases/tag/9.5.1-alpha.2Product, Release Notes
• https://github.com/parse-community/parse-server/security/advisories/GHSA-5j86-7r7m-p8h6Mitigation, Patch, Vendor Advisory

Published

Mar 10, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-30933FileBrowser Quantum is a free, self-hosted, web-based file m…7.5
• CVE-2026-30934FileBrowser Quantum is a free, self-hosted, web-based file m…5.4
• CVE-2026-30935ImageMagick is free and open-source software used for editin…4.4
• CVE-2026-30936ImageMagick is free and open-source software used for editin…5.5
• CVE-2026-30937ImageMagick is free and open-source software used for editin…6.1
• CVE-2026-30938Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-3094Delta Electronics CNCSoft-G2 lacks proper validation of the …7.8
• CVE-2026-30940baserCMS is a website development framework. Prior to versio…7.2
• CVE-2026-30941Parse Server is an open source backend that can be deployed …7.5
• CVE-2026-30942Flare is a Next.js-based, self-hostable file sharing platfor…6.5
• CVE-2026-30943Gokapi is a self-hosted file sharing server with automatic e…4.1
• CVE-2026-30944StudioCMS is a server-side-rendered, Astro native, headless …8.8