CVE-2026-110854

Awaiting Analysis Awaiting Analysis - Queue

Parse Server Email Verification Crash via Unhandled Errors

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110854

EUVD

EUVD-2026-101737

Affected Vendors & Products

Vendor	Product	Version / Range
parse-community	parse-server	0
parse-community	parse-server	9.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-248	An exception is thrown from a function, but it is not caught.

Attack-Flow Graph

Executive Summary

Parse Server versions before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 fail to handle errors during email verification or password reset processes. This causes the server to crash when email delivery fails due to rejection, rate limiting, or unavailability from the mail provider. An attacker with only public app keys can exploit this by triggering these operations.

Detection Guidance

Detecting this vulnerability requires checking if your Parse Server version is affected. Run 'npm list parse-server' to check the installed version. If it is below 8.6.97 or 9.0.0 before 9.10.2-alpha.6, the system is vulnerable. Monitor server logs for crashes during email verification or password reset attempts.

Impact Analysis

This vulnerability can cause service disruption by crashing the Parse Server, leading to downtime for applications relying on it. It may also expose user data if error handling reveals sensitive information during crashes. Availability of password reset and verification features would be compromised.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing service disruptions during email verification or password reset processes. If the server crashes due to email provider issues, it may lead to unauthorized access attempts or failed authentication, potentially violating data protection requirements under these regulations.

Mitigation Strategies

Upgrade Parse Server to version 8.6.97 or later, or 9.10.2-alpha.6 or later. Ensure mail provider configurations are correct to avoid errors during email operations. Implement error handling in email-related functions to prevent server crashes.

Hi! I’m here to help you understand CVE-2026-110854. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70