CVE-2026-109954: Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.
Affected Software
Event History
Frequently Asked Questions
Which deployments face the most severe impact?
The issue affects Parse Server versions from 5.4.0 before 8.6.96 and from 9.0.0 before 9.10.2-alpha.5. PostgreSQL deployments and MongoDB replica sets or sharded clusters can have other clients' acknowledged writes rolled back when a transactional batch fails; PostgreSQL deployments can also retain open transactions indefinitely, causing later writes to fail.
What must an attacker be able to do to exploit this?
An attacker needs network access to submit a transactional batch request to the affected Parse Server. No authentication or user interaction is required, but exploitation has high attack complexity because it relies on concurrent request timing.
How can teams determine whether they may be affected?
Check the Parse Server version and whether clients can send transactional batch requests concurrently. Systems using affected versions with PostgreSQL, MongoDB replica sets, or MongoDB sharded clusters should treat unexpected rolled-back acknowledged writes, persistent PostgreSQL transactions, or subsequent write failures as relevant indicators.