CVE-2026-109301
5.9MediumPublished 12 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-248
Impact
Attackers can crash the Parse Server process or break subsequent requests by triggering an unhandled exception. This requires writing to a class configured with Cloud Code triggers or LiveQuery, which may be reachable unauthenticated if public write access or sign-up is enabled.
Root cause
The server fails to resolve file references that lack a URL before handing objects to Cloud Code triggers and LiveQuery, throwing an uncaught exception that terminates the Node.js process.
Affected systems
Parse Server versions before 8.6.95, and 9.0.0 through versions before 9.10.2-alpha.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Fix & remediation
Upgrade Parse Server to 8.6.95, 9.10.2-alpha.3, or later. If upgrading immediately is not possible, restrict public write access and sign-ups on classes utilizing Cloud Code save/find/delete triggers or LiveQuery.
$ npm install parse-server@latestAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.