Parse Server, an open source Node.js backend, permits unauthenticated users to trigger a crash by invoking a Cloud Function endpoint with a prototype property name as the function argument. The server enters an infinite recursion during prototype chain resolution, which eventually causes a stack overflow and terminates the process. Additionally, requesting Cloud Function names that are prototype properties or contain dot notation bypasses dispatch validation, returning a misleading HTTP 200 response even when the function does not exist. The weakness is a flaw in prototype chain handling, identified as CWE‑1321.

This vulnerability applies to all Parse Server installations that expose the Cloud Function endpoint, specifically versions earlier than 8.6.13 and 9.5.1‑alpha.2. Administrators should review the version they run; the issue is resolved in the 8.6.13 release and the 9.5.1‑alpha.2 release. The affected product is the Parse Server open source backend for Node.js platforms.

The CVSS score of 8.8 indicates high severity, while the EPSS score of less than 1% implies a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only an unauthenticated HTTP request to the Cloud Function API; no privileged access or local code execution is needed. A successful exploit results in a service crash or unauthorized exposure of function responses, leading to denial of service and potential confusion for users of the affected system.