CVE-2026-109954
Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.
| CWE | CWE-362 |
| Vendor | parse-community |
| Product | parse-server |
| Published | Oct 13, 2026 |
Stay Ahead of the Next One
Get instant alerts for parse-community parse-server
Be the first to know when new medium vulnerabilities affecting parse-community parse-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
High
Affected Versions
parse-community / parse-server
9.0.0 < 9.10.2-alpha.5
parse-community / parse-server
5.4.0 < 8.6.96
References
Credits
mtrezza