CVE-2026-121414

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.110 Parse Server versions 9.0.0 through 9.10.6-alpha.1

Description A serialization error occurs during an object update when a dot notation key targets a pointer field's object identifier on a class that utilizes an afterSave() trigger. This flaw allows attackers, including unauthenticated clients in scenarios where objects are writable without a session, to trigger a crash of the Node process.

Recommendations Update Parse Server to version 8.6.110 or later. Update Parse Server to version 9.10.6-alpha.2 or later.