What’s Vulnerable › Vulnerabilities

CVE-2026-109954: Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-13
• Weakness: CWE-362

Description

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

Affected products

• parse-community parse-server: from 9.0.0 before 9.10.2-alpha.5; from 5.4.0 before 8.6.96 — fixed in 8.6.96, 9.10.2-alpha.5

How to fix

Upgrade to a fixed version: parse-community parse-server 8.6.96, 9.10.2-alpha.5. Check the vendor advisory for mitigations.

References

• https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv
• https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.2-alpha.5-transactional-batch-request-write-interference

Get alerted when CVE-2026-109954 or the next vulnerability affects your stack