npm/parse-server CVE-2026-32878: high 7.5, EPSS 0.36%

Parse Server vulnerable to schema poisoning via prototype pollution in deep copy

Action: Upgrade parse-server to 8.6.44 or later.

npm i parse-server@9.6.0-alpha.20

npm i parse-server@8.6.44

Affected

Fixed versions

Sources

• osv: GHSA-9ccr-fpp6-78qf
• nvd: CVE-2026-32878
• https://github.com/parse-community/parse-server/security/advisories/GHSA-9ccr-fpp6-78qf
• https://github.com/parse-community/parse-server/pull/10200
• https://github.com/parse-community/parse-server/pull/10201
• https://github.com/parse-community/parse-server

CVE-2026-32878 · published 2026-03-17T18:37:08Z · modified 2026-03-20T12:26:07.795927Z · JSON