CVE-2026-109954

8.3 highEPSS 0.2%

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

CVSS 4.0: 8.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS: 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)
CWE: CWE-362
Published: 2026-10-13
Modified: 2026-10-13
Record from: the NVD, synced 2026-10-19

References

https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv
https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.2-alpha.5-transactional-batch-request-write-interference

Check your stack JSON