Parse Server EUVD-2026-115946

Exploitation requires three concrete conditions from the advisory: (1) the targeted Parse class must have an afterSave trigger registered - classes without an afterSave trigger complete the identical request normally and are not affected; (2) that class must contain a pointer field; and (3) the malicious update must use a dot-notation key that targets the pointer field's internal object identifier (e.g. 'owner.id' with an __op Delete or a null value). The request can be made without authentication only when the targeted object is writable without a session; otherwise the attacker needs whatever write access the object's ACL/CLP demands. The requirement for an afterSave trigger on a pointer-bearing, writable class is the main limiting factor restricting which deployments are exploitable.

This is a genuine but bounded denial-of-service issue, not a code-execution or data-exposure threat. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) is consistent with the advisory: network-reachable, low attacker complexity, no privileges required when the targeted object is writable without a session, and impact limited to availability (VA:H) with no confidentiality or integrity effect. The AT:P (attack requirement present) metric is well grounded - exploitation only works against a class that both has an afterSave trigger and contains a pointer field, so the flaw is conditional on application design rather than universal. No EPSS score is provided and the CVE is not on CISA KEV, so there is no evidence of active exploitation; the vuln.today decision label is 'this_week' (not act_now/emergency), indicating prompt-but-not-crash remediation urgency. The GitHub advisory and the fix PRs include regression tests that reproduce the crash, so the trigger is publicly documented. Weighing these signals together: the real-world risk is a reliable, low-effort, potentially unauthenticated process crash against vulnerable Parse Server deployments that use afterSave triggers on pointer-bearing classes - a meaningful availability risk for exposed instances, but one with no exploitation telemetry and a narrowing configuration precondition. Treat as a real priority for affected deployments rather than a theoretical high-CVSS item.

An attacker with the ability to submit an object update (unauthenticated if the target object is writable without a session) sends a single crafted PUT to a class that has an afterSave trigger, using a dot-notation key that targets a pointer field's object identifier (e.g. {"owner.id": {"__op": "Delete"}}). The pointer passed to the trigger loses its identifier and can no longer be serialized, the uncontained error terminates the Node process, and all clients lose service until the server is restarted. The advisory and the fix PRs contain regression tests that reproduce this crash, so the trigger is publicly documented.