CVE-2026-110854: Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error
Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the denial of service?
Any client with the public application keys can trigger it. No privileged account or administrative access is required.
What conditions are required for exploitation?
The server must attempt to send a verification or password-reset email while its mail provider is rejecting requests, rate limiting them, or unavailable. An attacker can then sign up, request verification email, or request a password reset to cause the process to exit.
Are deployments affected by email-related workflows at risk?
Deployments that allow sign-up, verification-email requests, or password-reset requests are exposed when the configured mail provider returns an error. The provided data does not state whether any particular email workflow is enabled by default.
What versions contain the fix?
The issue is addressed in Parse Server 8.6.97 and 9.10.2-alpha.6. Affected version ranges are versions before 8.6.97 and 9.0.0 through versions before 9.10.2-alpha.6.