CVE-2026-121965 Parse Server before 8.6.113 and 9.10.6-alpha.5 Prototype Pollution via Dot Notation Key
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121965?
CVE-2026-121965 is a medium-severity vulnerability in parse-community parse-server, published on 4 Nov 2026.
Official description
Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building objects for Cloud Code triggers and LiveQuery, where a dot notation key whose intermediate segment resolves through an inherited member writes onto a process-wide built-in. Clients with write access to an object in a class with a trigger or LiveQuery can corrupt a built-in function, making unrelated requests fail until restart and denying service to all clients and hosted applications.
Weakness: CWE-1321
Which versions are affected by CVE-2026-121965?
How do I fix CVE-2026-121965?
No fix has been published for CVE-2026-121965 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121965 being exploited?
There is no known exploitation of CVE-2026-121965 in the wild and no public exploit code.
Sources
Also known as GHSA-95hp-82c6-25q5, GHSA-vx56-7cxr-7m5w.