Denial of Service Vulnerability in Parse Server by Parse Community
CVE-2026-109301

8.2HIGH

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109301?

In Parse Server, versions prior to 8.6.95 and 9.0.0 before 9.10.2-alpha.3, a flaw exists that allows the server to crash due to the handling of file references lacking a URL. This vulnerability arises when objects are passed to Cloud Code triggers and LiveQuery, leading to an uncaught exception that terminates the server process. Attackers with permissions to write to classes with enabled Cloud Code triggers, including unauthenticated users in environments with public write access, can exploit this issue to disrupt service continuity by crashing the server or compromising subsequent requests.

Affected Version(s)

parse-server 9.0.0 < 9.10.2-alpha.3

parse-server 0 < 8.6.95

parse-server 9.10.2-alpha.3

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://www.vulncheck.com/advisories/parse-server-before-...
third-party-advisory

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
.