CVE-2026-121414: Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update

Published Nov 3, 2026

Updated

Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Parse Server to a version that resolves this vulnerability.
Fixed in 8.6.110
Upgrade
Upgrade Parse Server to a version that resolves this vulnerability.
Fixed in 9.10.6-alpha.2

Event History

Nov 3, 2026

CVE Published

via MITRE·02:28 PM

Data Sourced

via MITRE·02:28 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are most exposed to unauthenticated attacks?

Deployments with a class that has an afterSave trigger and permits object writes without a session are exposed to unauthenticated clients. Other affected deployments may still be vulnerable if an attacker can perform the required object update.

What request is required to trigger the denial of service?

An attacker must submit an object update using a dot-notation key that targets the object identifier of a pointer field. The affected class must have an afterSave trigger, causing an uncontained serialization error that crashes the Node process.

What can be done while patching is delayed?

Restrict object writes so they require a session, especially for classes with afterSave triggers. This removes the described unauthenticated attack path, though authenticated clients able to submit the crafted update may still pose a risk.

How can I identify potentially affected classes?

Review classes that have afterSave triggers and identify pointer fields on those classes. Check whether clients can update those objects using dot-notation keys, particularly whether writes are allowed without a session.

CVE-2026-121414: Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 Denial of Service via afterSave Pointer Update

Remediation

Event History

Frequently Asked Questions

Which deployments are most exposed to unauthenticated attacks?

What request is required to trigger the denial of service?

What can be done while patching is delayed?

How can I identify potentially affected classes?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to unauthenticated attacks?

What request is required to trigger the denial of service?

What can be done while patching is delayed?

How can I identify potentially affected classes?