CVE-2026-109954
6.5MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-362
Impact
Remote unauthenticated attackers can roll back other clients' database writes and lock up database transactions to cause a denial of service. They only need network access to send concurrent transactional batch requests to the Parse Server API.
Root cause
Parse Server shares transactional batch state across concurrent requests instead of isolating transactions per request.
Affected systems
Parse Server 5.4.0 before 8.6.96, and 9.0.0 before 9.10.2-alpha.5 (using PostgreSQL or MongoDB replica sets/sharded clusters)
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Fix & remediation
Upgrade Parse Server to 8.6.96, 9.10.2-alpha.5, or later. No workaround or interim mitigation is provided in the advisory.
$ npm install parse-server@latestAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.