CVE-2026-109301: Uncaught Exception in parse-community parse-server
Description
Parse Server versions before 8.6.95 and versions from 9.0.0 up to but not including 9.10.2-alpha.3 contain a vulnerability where file references lacking a URL are not resolved before being passed to Cloud Code triggers and LiveQuery. This causes an uncaught exception that terminates the server process. Attackers with the ability to write to classes with Cloud Code triggers or LiveQuery enabled, including unauthenticated users if public write access or sign-up is allowed, can exploit this to crash the server or disrupt subsequent requests.
CVSS v4.0
Score 8.2high
Affected software
parse-community
parse-server
parse-community
parse-server
pkg:github/parse-community/parse-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-109301 affects parse-community's parse-server. The vulnerability arises because file references without URLs are not resolved before objects are passed to Cloud Code triggers and LiveQuery, leading to an uncaught exception that terminates the server process. This can be triggered by attackers who can write to classes with Cloud Code save, find, or delete triggers or LiveQuery enabled. The vulnerability impacts versions prior to 8.6.95 and versions from 9.0.0 up to 9.10.2-alpha.3.
Potential Impact
Successful exploitation results in an uncaught exception that crashes the parse-server process, causing denial of service and disruption of subsequent requests. Attackers with write access to affected classes, including unauthenticated users if public write or sign-up is enabled, can trigger this condition, potentially impacting availability of the service.
Mitigation Recommendations
A fix is available in parse-server version 8.6.95 and in versions starting from 9.10.2-alpha.3. Users should upgrade to these versions or later to remediate the vulnerability. If upgrading is not immediately possible, restricting write access to classes with Cloud Code triggers or LiveQuery enabled, especially disabling public write access or sign-up, can reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-12T14:13:39.027Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6acd0c112cdf04f656b11be2
Added to database: 10/12/2026, 16:34:25 UTC
Last enriched: 10/12/2026, 17:19:24 UTC
Last updated: 10/12/2026, 21:46:49 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.