A critical vulnerability in Parse Server allows unauthenticated attackers to cause a denial of service via a prototype pollution attack, necessitating an immediate update.

The application suffers from improper control of object prototype attributes (CWE-1321), where unauthenticated remote users can traverse the JavaScript prototype chain during cloud function name resolution to induce a stack overflow.

The vulnerability poses a significant risk to service availability by enabling unauthenticated attackers to crash the backend process at will. With a CVSS score of 7.5, this high severity flaw could lead to extended periods of downtime for applications relying on the Parse Server infrastructure, resulting in operational disruption and potential reputational damage.

Immediate Action: Upgrade Parse Server to version 9.6.0-alpha.24 or 8.6.47 immediately to apply the fix for property lookup restrictions.

Proactive Monitoring: Monitor server logs for an unusual frequency of process restarts or repeated failed requests directed at the cloud function resolution endpoint.

Compensating Controls: While no direct workaround exists, implement rate limiting at the network edge to restrict the volume of requests targeting cloud function endpoints, which may mitigate the impact of automated crash attempts.

Public Exploit Available: No — there is no confirmed public exploit available in the provided data.

Given the high severity of this vulnerability and the potential for complete service disruption, administrators should prioritize the deployment of the patched versions identified above. The fix effectively neutralizes the prototype pollution vector by restricting property lookups, and applying this update is the only reliable method to eliminate the risk of remote process termination.