Transactional Batch State Interference in Parse Server by Parse Community

CVE-2026-109954

What is CVE-2026-109954?

The Parse Server versions prior to 8.6.96 and 9.10.2-alpha.5 exhibit a vulnerability where transactional batch state is shared among concurrent requests. This flaw allows a client's batch request to disrupt the database writes of other clients. In environments using PostgreSQL or MongoDB, the rollback of successful writes occurs when a batch transaction fails, which can lead to prolonged open transactions in PostgreSQL. This disruption may ultimately result in subsequent write operations failing due to compromised data integrity.

References