CVE-2026-109301: Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL

Q: Which deployments are exposed to unauthenticated denial-of-service?

Deployments are exposed without authentication when an affected class permits public writes or user sign-up is allowed, and that class has Cloud Code save, find, or delete triggers or LiveQuery enabled. Other affected deployments require an attacker to be able to write to such a class.

Q: What configuration makes a writable class susceptible?

The class must have Cloud Code save, find, or delete triggers configured, or have LiveQuery enabled. A file reference lacking a URL can then reach those components and cause an uncaught exception.

Q: What is the practical impact of successful exploitation?

Successful exploitation can terminate the Parse Server process. It can also cause subsequent requests to fail.

Q: What can be done before updating?

Restrict write access to classes that use Cloud Code save, find, or delete triggers or LiveQuery, and disable public writes or unrestricted sign-up where those paths are exposed. These measures reduce the ability of an unauthenticated attacker to submit the triggering object.

Published Oct 12, 2026

Updated

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.

Affected Software

1 affected component

Parse Parse Server<8.6.95, >=9.0.0<9.10.2-alpha.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Parse Server to a version that resolves this vulnerability.
Fixed in 8.6.95
Upgrade
Upgrade Parse Server to a version that resolves this vulnerability.
Fixed in 9.10.2-alpha.3

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to unauthenticated denial-of-service?

Deployments are exposed without authentication when an affected class permits public writes or user sign-up is allowed, and that class has Cloud Code save, find, or delete triggers or LiveQuery enabled. Other affected deployments require an attacker to be able to write to such a class.

What configuration makes a writable class susceptible?

The class must have Cloud Code save, find, or delete triggers configured, or have LiveQuery enabled. A file reference lacking a URL can then reach those components and cause an uncaught exception.

What is the practical impact of successful exploitation?

Successful exploitation can terminate the Parse Server process. It can also cause subsequent requests to fail.

What can be done before updating?

Restrict write access to classes that use Cloud Code save, find, or delete triggers or LiveQuery, and disable public writes or unrestricted sign-up where those paths are exposed. These measures reduce the ability of an unauthenticated attacker to submit the triggering object.

CVE-2026-109301: Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to unauthenticated denial-of-service?

What configuration makes a writable class susceptible?

What is the practical impact of successful exploitation?

What can be done before updating?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to unauthenticated denial-of-service?

What configuration makes a writable class susceptible?

What is the practical impact of successful exploitation?

What can be done before updating?