CVE-2026-110854
8.2HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- High impact on availability
- Weakness
- CWE-248
Impact
Remote unauthenticated attackers holding only public application keys can crash the server process by triggering verification or password reset emails when the mail provider fails or rate-limits requests. This leads to a persistent denial of service.
Root cause
Unhandled errors when sending verification or password reset emails cause the Node.js process to exit unexpectedly.
Affected systems
Parse Server versions prior to 8.6.97, and 9.0.0 through versions prior to 9.10.2-alpha.6
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade to Parse Server 8.6.97, 9.10.2-alpha.6, or newer. If unable to patch immediately, ensure your email provider integration never throws unhandled rejections or temporarily disable client-triggered email verification and password reset flows.
$ npm install parse-server@latestAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.