Description
Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Prior to 9.6.0-alpha.24 and 8.6.47, remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow. The fix in versions 9.6.0-alpha.24 and 8.6.47 restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers. There is no known workaround.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| parse-community | parse-server | >= 9.0.0, < 9.6.0-alpha.24, < 8.6.47 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | parse-server | >= 9.0.0, < 9.6.0-alpha.24 | 9.6.0-alpha.24 | GHSA-4263-jgmp-7pf4 |
| npm | parse-server | < 8.6.47 | 8.6.47 | GHSA-4263-jgmp-7pf4 |