CVE-2026-121415

Name of the Vulnerable Software and Affected Versions Parse Server versions prior to 8.6.111 Parse Server versions 9.0.0 through 9.10.6-alpha.2

Description When used with MongoDB, the software skips field type validation for null-valued dot notation keys. This allows sub-documents to be written beneath fields defined as Pointer, Number, String, Date, or Boolean. Clients with write access, including unauthenticated users when public writes are enabled, can corrupt field values, render objects unreadable through internal date fields, or disrupt atomic operations on number fields.

Recommendations Update Parse Server to version 8.6.111 or later. Update Parse Server to version 9.10.6-alpha.3 or later.