CVE-2026-109301 in Parse Server
Summary
by MITRE • 10/12/2026
Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete triggers or LiveQuery enabled, including unauthenticated users when public write access or sign-up is allowed, can crash the server or break subsequent requests.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Parse Server versions prior to 8.6.95 and 9.0.0 before 9.10.2-alpha.3 represents a critical reliability flaw rooted in improper input validation within the object processing pipeline. Specifically, when objects containing file references that lack an associated URL are passed through Cloud Code triggers or LiveQuery systems, the server fails to resolve these incomplete references correctly. This oversight leads directly to an uncaught exception during runtime execution. In software engineering terms, this is a classic example of insufficient validation leading to application instability, where the system assumes all provided file objects contain valid metadata such as URLs before attempting to process them further. The absence of robust error handling for malformed or incomplete data structures allows this internal state corruption to propagate unchecked through the request lifecycle.
From an operational perspective, the impact of this vulnerability is severe due to its potential for causing denial-of-service conditions. When a malicious actor triggers one of these affected code paths by submitting an object with a file reference missing a URL, the Parse Server process encounters a fatal error and terminates immediately. This crash disrupts service availability not only for the specific request that triggered the exception but potentially for all subsequent requests if the server is configured to restart automatically or fails to recover gracefully from such state corruption. For environments relying on high availability, this behavior effectively allows an attacker to bring down the entire backend infrastructure by simply crafting a single malformed payload that exploits the lack of defensive programming practices in the trigger execution engine.
The attack surface for this vulnerability includes any class within the Parse application where Cloud Code save, find, or delete triggers are enabled, as well as classes with LiveQuery subscriptions active. Crucially, if public write access is permitted or user sign-up is allowed without strict authentication requirements, unauthenticated attackers can exploit this flaw remotely. This means that even users who have not verified their identity or possess no elevated privileges can trigger the crash condition by interacting with exposed endpoints and submitting data containing invalid file reference structures. The ease of exploitation combined with the high impact on service availability classifies this as a significant security risk, particularly for applications where uptime is critical and public-facing APIs are prevalent.
In terms of industry standard classifications, this vulnerability aligns closely with CWE-20 Improper Input Validation, specifically regarding the failure to validate that required fields or data structures meet expected formats before processing. Additionally, because it enables a denial-of-service condition through remote interaction without authentication in some configurations, it relates to ATT&CK technique T1499 Endpoint Denial of Service, where an adversary disrupts access to an asset by exhausting resources or causing crashes. The specific mechanism involves manipulating object properties to trigger unhandled exceptions, which is also characteristic of CWE-755 Improper Handling of Exceptional Conditions when the application fails to catch and handle expected error states gracefully during data ingestion.
To mitigate this vulnerability, organizations must upgrade Parse Server immediately to version 8.6.95 or later for the 8.x branch, or version 9.10.2-alpha.3 and later for the 9.x development line. These releases include patches that properly validate file references before passing them into Cloud Code triggers and LiveQuery handlers, ensuring that missing URLs are handled gracefully rather than causing a process termination. Furthermore, administrators should review their security configurations to restrict write access on sensitive classes where possible, enforcing authentication requirements even for sign-up processes if feasible. Implementing strict input validation at the API gateway level or within custom middleware can provide an additional layer of defense against malformed payloads attempting to exploit this logic flaw before it reaches the core server components.