CVE-2026-31840: Parse Logical Op Array Like Bypasscve-2026-31840-parse-logical-op-array-like-bypass
Iterating over Parse logical operators ('$or', '$and', '$nor') and gating processing only on Array.isArray(where[op]) allows an attacker to supply an array-like object (e.g. { '0': {...}, length: 1 }). The Array.isArray branch is skipped while downstream code can still iterate the object, silently bypassing recursive guards (such as protectedFields enforceme
