parse-server has cloud function validator bypass via prototype chain traversal
Impact
An attacker can bypass Cloud Function validator access controls by appending .prototype.constructor to the function name in the URL. When a Cloud Function handler is declared using the function keyword and its validator is a plain object or arrow function, the trigger store traversal resolves the handler through its own prototype chain while the validator store fails to mirror this traversal, causing all access control enforcement to be skipped.
This allows unauthenticated callers to invoke Cloud Functions that are meant to be protected by validators such as requireUser, requireMaster, or custom validation logic.
Patches
The trigger store traversal now verifies that each intermediate node is a legitimate store object before continuing traversal. If the traversal encounters a non-store value such as a function handler, it stops and returns an empty store, preventing prototype chain escape.
Workarounds
Use arrow functions instead of the function keyword for Cloud Function handlers. Arrow functions do not have a prototype property and are not affected by this vulnerability.
Resources
- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6
- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10342
- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10343
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | parse-server | >= 9.0.0, < 9.7.0-alpha.11, < 8.6.67 | 9.7.0-alpha.11, 8.6.67 |
References
- https://github.com/parse-community/parse-server/security/advisories/GHSA-vpj2-qq7w-5qq6
- https://nvd.nist.gov/vuln/detail/CVE-2026-34532
- https://github.com/parse-community/parse-server/pull/10342
- https://github.com/parse-community/parse-server/pull/10343
- https://github.com/parse-community/parse-server/commit/4fc48cf28f22eea200d74d883505f485234a48d7
- https://github.com/parse-community/parse-server/commit/dc59e272665644083c5b7f6862d88ce1ef0b2674
- https://github.com/parse-community/parse-server
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N- Weakness (CWE)
CWE-863- Platform
- npm
- Package
parse-server- Disclosed
- 31.03.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-vpj2-qq7w-5qq6 - CC BY 4.0
Vulnerability history: parse-server
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 116
- First → latest
- 06.2019 06.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 17
- High 49
- Medium 40
- Low 10
Disclosures per year
- 2019: 2
- 2020: 4
- 2021: 4
- 2022: 12
- 2023: 5
- 2024: 4
- 2025: 6
- 2026: 79
-
parse-server has cloud function validator bypass via prototype chain traversal this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.