Serialization Error in Parse Server Affects Multiple Versions
CVE-2026-121414

8.2HIGH

Key Information:

Vendor

Parse-community

Status
Parse-server
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121414?

A vulnerability in Parse Server allows unauthenticated clients to exploit a serialization error when object updates utilize dot notation keys targeting pointer fields' object identifiers. This issue occurs on classes configured with afterSave triggers and can lead to crashes in the Node process when writable objects are exposed without session validation.

Affected Version(s)

parse-server 9.0.0 < 9.10.6-alpha.2

parse-server 0 < 8.6.110

parse-server 9.10.6-alpha.2

References

https://github.com/parse-community/parse-server/security/...
vendor-advisory
https://github.com/parse-community/parse-server/pull/10802
patchissue-tracking
https://github.com/parse-community/parse-server/pull/10803
patchissue-tracking

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

mtrezza
.