---
id: "CVE-2026-116164"
kind: "vulnerability"
aliases: ["CVE-2026-116164"]
title: "Parse Server: client writes to reserved internal fields break reads and lockouts"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mongodb", "node", "package", "parse-server", "self-hosted"]
not_affected_if: ["patched-version", "server-side-only-writes"]
published_at: "2026-10-25T14:16:55+00:00"
first_seen_at: "2026-10-25T14:41:22+00:00"
updated_at: "2026-10-25T14:42:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116164", "first_seen_at": "2026-10-25T14:41:22+00:00"}]
---

# Parse Server: client writes to reserved internal fields break reads and lockouts

Parse Server does not reject reserved internal field names in client object writes, so a client can store or clear internal fields. An attacker can write a reserved field that makes object reads fail on MongoDB, disrupting queries for that class, or clear their own lockout state and password history to bypass lockout and password policy.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Parse Server version with `npm ls parse-server` or by reading `version` in `node_modules/parse-server/package.json`.
- Check whether the app uses MongoDB as its database.

## Fix

- Upgrade parse-server to `8.6.100` or later on the 8.x line.
- Upgrade parse-server to `9.10.4-alpha.3` or later on the 9.x line; `9.0.0` through `9.10.4-alpha.2` are affected.

## Timeline

- 2026-10-25T14:41:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116164

## From the sources

Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client object writes, allowing clients to store or clear internal fields. Attackers can write a reserved field that makes reads of an object fail on MongoDB, disrupting queries on that class for all users, or clear their own account lockout state and password history to bypass lockout and password policies.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_