Parse Server prior to version 8.6.113 and before 9.10.6‑alpha.5 is vulnerable to prototype pollution when building objects for Cloud Code triggers and LiveQuery. A client can supply a dot notation key whose intermediate segment resolves through an inherited member and write onto a process‑wide built‑in. This corruption of a built‑in function causes unrelated requests to fail until the server is restarted, resulting in a denial of service for all clients and hosted applications.

The vulnerability affects the Parse Server product from parse‑community, specifically versions earlier than 8.6.113 and 9.10.6‑alpha.5. Clients running these builds and writing to objects in classes that have Cloud Code triggers or LiveQuery interfaces are impacted.

The CVSS score of 6.0 indicates medium severity, but the EPSS score is unavailable, so exploitation likelihood is unclear. The vulnerability is not listed in CISA KEV. Attackers require write permissions to an object in a class that has triggers or LiveQuery; the attack vector is client‑side via normal API calls. If exploited, the server will be rendered non‑functional until a restart, denying service to all users.