What is GHSA-4263-jgmp-7pf4?

GHSA-4263-jgmp-7pf4 is a security advisory published by GitHub Security Advisories with High severity. Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Which CVE IDs does GHSA-4263-jgmp-7pf4 cover?

GHSA-4263-jgmp-7pf4 covers the following CVE IDs: CVE-2026-32886. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-4263-jgmp-7pf4?

GHSA-4263-jgmp-7pf4 affects 2 products, including: npm/parse-server:\u003e= 9.0.0, \u003c 9.6.0-alpha.24; npm/parse-server:\u003c 8.6.47.

GHSA-4263-jgmp-7pf4High

Parse Server's Cloud function dispatch crashes server via prototype chain traversal

Vendor

GitHub Security Advisories

Published

March 17, 2026

Last Modified

March 19, 2026

🔗 CVE IDs covered (1)

CVE-2026-32886 →

📋 Description

Impact

Remote clients can crash the Parse Server process by calling a cloud function endpoint with a crafted function name that traverses the JavaScript prototype chain of a registered cloud function handler, causing a stack overflow.

Patches

The fix restricts property lookups during cloud function name resolution to own properties only, preventing prototype chain traversal from stored function handlers.

Workarounds

There is no known workaround.

🎯 Affected products2

npm/parse-server:>= 9.0.0, < 9.6.0-alpha.24
npm/parse-server:< 8.6.47

🔗 References (5)

https://github.com/parse-community/parse-server/security/advisories/GHSA-4263-jgmp-7pf4
https://github.com/parse-community/parse-server/pull/10210
https://github.com/parse-community/parse-server/pull/10211
https://nvd.nist.gov/vuln/detail/CVE-2026-32886
https://github.com/advisories/GHSA-4263-jgmp-7pf4