CVE-2026-110854: Uncaught Exception in parse-community parse-server
Description
Parse Server versions before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 have a vulnerability where errors during sending verification or password reset emails are not handled properly, causing the server process to crash. This can be triggered by a client using only public application keys when the mail provider rejects, rate limits, or is unavailable.
CVSS v4.0
Score 8.2high
Affected software
parse-community
parse-server
pkg:github/parse-community/parse-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-110854 affects parse-community's parse-server in versions prior to 8.6.97 and 9.0.0 before 9.10.2-alpha.6. The vulnerability arises because the server does not handle exceptions raised during the sending of verification or password reset emails. When the mail provider rejects, rate limits, or is unavailable, this unhandled exception causes the server process to exit. An unauthenticated client holding only public application keys can trigger this by signing up or requesting email actions, leading to a denial of service through server crash.
Potential Impact
The vulnerability can cause the parse-server process to crash, resulting in denial of service. Attackers with only public application keys can trigger this by requesting verification or password reset emails when the mail provider is rejecting or unavailable, disrupting service availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, monitor mail provider availability and consider temporary mitigations such as rate limiting requests for verification or password reset emails to reduce the risk of triggering the crash.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-14T22:16:22.734Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad00a642cdf04f656ba02f4
Added to database: 10/14/2026, 23:04:04 UTC
Last enriched: 10/14/2026, 23:19:01 UTC
Last updated: 10/14/2026, 23:20:01 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.