{"schema":"threatline.record/2","record":{"id":"GHSA-jhh9-hrgh-c9gv","aliases":["GHSA-jhh9-hrgh-c9gv"],"summary":"Transactional batch request can roll back or block writes of other clients","details":"### Impact\r\n\r\nA transactional batch request sent by any client can interfere with database writes of other clients that run at the same time. On PostgreSQL, a MongoDB replica set or a MongoDB sharded cluster, these writes become part of the batch's database transaction and are rolled back if the batch fails, although those clients received a success response. On a standalone MongoDB, these writes fail while the batch is in progress. On PostgreSQL, the request can also leave a database transaction open indefinitely, holding its locks and database connection, and cause subsequent write requests of all clients to fail. This affects deployments that set the Parse Server option `masterKey` to a function, register a Cloud Code validator with `rateLimit` after the server has started, or set `Parse.Server` at runtime.\r\n\r\n### Patches\r\n\r\nEach request now always uses its own database controller, which holds the state of a transactional batch. Loading the master key no longer writes request-scoped configuration to the server-wide configuration cache, and a transaction cannot be started while another one is active on the same database controller.\r\n\r\n### Workarounds\r\n\r\nSet the Parse Server option `masterKey` to a string instead of a function, and do not register Cloud Code validators with `rateLimit` or set `Parse.Server` after the server has started.\r\n\r\n### References\r\n\r\n- GitHub security advisory: https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv\r\n- Fix Parse Server 9: https://github.com/parse-community/parse-server/pull/10713\r\n- Fix Parse Server 8: https://github.com/parse-community/parse-server/pull/10716\r\n","categories":["Unclassified"],"product":"parse-server","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv","source_modified_at":"2026-09-28T22:45:02Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"npm","name":"parse-server"},"range":">= 9.0.0, < 9.10.2-alpha.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv","source_modified_at":"2026-09-28T22:45:02Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"npm","name":"parse-server"},"range":">= 5.4.0, < 8.6.96"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv","source_modified_at":"2026-09-28T22:45:02Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"9.10.2-alpha.5"},{"source":"GitHub Advisory Database","source_url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv","source_modified_at":"2026-09-28T22:45:02Z","fetched_at":"2026-10-23T18:58:35.272684Z","package":{"ecosystem":"npm","name":"parse-server"},"version":"8.6.96"}],"cvss":8.3,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-09-28T22:45:02Z","modified_at":"2026-09-28T22:45:02Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv","fetched_at":"2026-10-23T18:58:35.272684Z","source_modified_at":"2026-09-28T22:45:02Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-28T22:45:02Z","content_hash":"843d2269a3699fa92d1b5e6d3f87fd58694943d38c84870c185cee8a5dd0d514"}}