CVE-2026-121415
Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.
| CWE | CWE-20 |
| Vendor | parse-community |
| Product | parse-server |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for parse-community parse-server
Be the first to know when new low vulnerabilities affecting parse-community parse-server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
Low
Affected Versions
parse-community / parse-server
9.0.0 < 9.10.6-alpha.3
parse-community / parse-server
0 < 8.6.111
References
github.com: https://github.com/parse-community/parse-server/security/advisories/GHSA-655c-2xf3-77x9 github.com: https://github.com/parse-community/parse-server/pull/10804 github.com: https://github.com/parse-community/parse-server/pull/10805 vulncheck.com: https://www.vulncheck.com/advisories/parse-server-before-8.6.111-and-9.0.0-before-9.10.6-alpha.3-field-corruption-via-null-dot-notation-key
Credits
mtrezza