All vulnerabilities
CVE-2026-109301GHSA-gpr6-gr9g-pfw6

parse-server: Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 Denial of Service via File Pointer Without URL

parse-community parse-server
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.35%Chance of exploitation activity in the next 30 days, higher than 27% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in9.10.2-alpha.3Also 8.6.95CVE List
Published12 Oct 2026Updated 18 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.

Text from CVE List

Affected versions 4

  • parse-serveraffected: 9.0.0 before 9.10.2-alpha.3CVE List
  • parse-serverunaffected: 9.10.2-alpha.3CVE List
  • parse-serveraffected: all versions before 8.6.95CVE List
  • parse-serverunaffected: 8.6.95CVE List

References 2