npm/parse-server CVE-2026-32886: high 7.5, EPSS 0.54%

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Action: Upgrade parse-server to 8.6.47 or later.

npm i parse-server@9.6.0-alpha.24

npm i parse-server@8.6.47

Affected

Fixed versions

Sources

• osv: GHSA-4263-jgmp-7pf4
• nvd: CVE-2026-32886
• https://github.com/parse-community/parse-server/security/advisories/GHSA-4263-jgmp-7pf4
• https://github.com/parse-community/parse-server/pull/10210
• https://github.com/parse-community/parse-server/pull/10211
• https://github.com/parse-community/parse-server

CVE-2026-32886 · published 2026-03-17T17:58:08Z · modified 2026-03-20T12:26:16.149865Z · JSON