CVE-2026-119126

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.106 Parse Server versions 9.0.0 through 9.10.5-alpha.6

Description An issue exists where the software mishandles dot notation keys containing null or undefined values during the construction of the saved object. This causes a write operation to be stored in the database while simultaneously returning an error, which subsequently bypasses afterSave triggers and LiveQuery events. A client with write access can leverage this behavior to evade audit logging, notifications, and updates to derived data.

Recommendations Update Parse Server to version 8.6.106 or later. Update Parse Server to version 9.10.5-alpha.7 or later.