Race condition in Parse Server batch requests rolls back other clients' writes
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, a race condition (CWE-362) that lets any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing later writes to fail. An unauthenticated remote attacker can trigger this by sending a transactional batch request.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
Description from the CNA
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| parse-community | parse-server | 9.0.0 to before 9.10.2-alpha.5 | 9.10.2-alpha.5 | Patch available | CNA |
| parse-community | parse-server | 5.4.0 to before 8.6.96 | 8.6.96 | Patch available | CNA |
- parse-server Vendorparse-community Affected 9.0.0 to before 9.10.2-alpha.5 Fixed in 9.10.2-alpha.5 Patch available CNA
- parse-server Vendorparse-community Affected 5.4.0 to before 8.6.96 Fixed in 8.6.96 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:* | — | — | parse-community |
- cpe:2.3:a:parseplatform:parse-server:*:*:*:*:*:*:*:* Versions — — ·parse-community
Remediation
Upgrade parse-server to 8.6.96 for the 8.x line and to 9.10.2-alpha.5 for the 9.x line. The sources list no fixed version for parse-server in other release lines.
Written with Claude Haiku 5.5 from the sources below · 2026-10-27
- Fix · CNA parse-server (parse-community) Fixed in 9.10.2-alpha.5
- Fix · CNA parse-server (parse-community) Fixed in 8.6.96
Timeline
- 2026-10-13 Threatist record created from CVE-2026-109954
- 2026-10-13 Alias added: GHSA-jq9m-gc39-vm65
- 2026-10-13 CISA SSVC decision points changed
- 2026-10-13 Priority changed: MEDIUM → LOW
References
More parse-community vulnerabilities
- TI-2022-08574 Command Injection in Parse server CVSS 3.1CRITICAL 10.0
- TI-2024-18136 Parse Server literalizeRegexPart SQL Injection CVSS 3.1CRITICAL 10.0
- TI-2022-18768 Parse Server vulnerable to Remote Code Execution via prototype pollution in MongoDB BSON parser CVSS 3.1CRITICAL 9.8
- TI-2024-31550 Parse Server's custom object ID allows to acquire role privileges CVSS 3.1HIGH 8.1
- TI-2025-35510 parse is a package designed to parse JavaScript SDK. CVSS 3.1MEDIUM 6.5
- TI-2024-26265 ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerability CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-109954 · CVE Program
- CVE-2026-109954 · NVD
- FIRST EPSS
- GHSA-jq9m-gc39-vm65 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences