Parse Server uses user-controlled keys without own-property checks, enabling prototype pollution. Attackers with class write permissions can craft dot notation field keys or ACL names that overwrite built-in object members. This corrupts internal functions, causing every server request to fail until a restart, resulting in denial of service.

Parse Server by the parse-community, versions 8.x prior to 8.6.108 and 9.x before 9.10.5-alpha.9 are affected.

The CVSS score of 6 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. Exploitation requires an attacker who controls a client with write class access to inject malicious field keys or ACL names. Such an attacker can trigger the prototype pollution, corrupting server behavior until a restart.