CVE-2026-109954
Received Received - Intake

State Sharing Flaw in Parse Server Allows Write Rollback

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: VulnCheck

Description
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-109954
EUVD
EUVD-2026-98658

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
parse-community parse-server 9.0.0
parse-community parse-server 5.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a race condition in Parse Server versions 5.4.0 to 8.6.95 and 9.0.0 to 9.10.2-alpha.4 where concurrent transactional batch requests share state improperly. This allows one client's failed batch to interfere with other clients' database writes, causing rollbacks or indefinite transaction locks.

Detection Guidance

Check Parse Server version with: npm list parse-server. If running versions 5.4.0-8.6.95 or 9.0.0-9.10.2-alpha.4, the system is vulnerable. Monitor PostgreSQL for open transactions with: SELECT * FROM pg_stat_activity WHERE state = 'idle in transaction'; and MongoDB for write failures during concurrent batch requests.

Impact Analysis

It can cause data loss or corruption as other clients' acknowledged writes are rolled back if a batch fails. On PostgreSQL, it may leave transactions open indefinitely, blocking all subsequent writes. This disrupts database operations and availability.

Mitigation Strategies

Upgrade Parse Server to versions 8.6.96 or 9.10.2-alpha.5 or later. As temporary workarounds, set masterKey to a string, avoid dynamic Cloud Code validator registration with rateLimit, or do not set Parse.Server after startup.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart