Live › vulnerability › CVE-2026-119126
Parse Server stores a write with dot-notation keys set to null or undefined but returns an error to the client. The save skips afterSave triggers and LiveQuery events, so a client with write access can bypass audit logging, notifications and derived data updates.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:25 UTC. All times on this page are UTC.
Applications that run Parse Server 8 before 8.6.106 or 9 before 9.10.5-alpha.7 and let clients write objects with dot-notation keys. The impact is limited to triggers and audit or notification logic that depends on afterSave or LiveQuery, so teams with no such hooks have less at stake. Teams that run only read-only clients or do not use these hooks can deprioritise it.
No product ranges from the sources yet.
npm ls parse-server in the server project.parse-server dependency in package.json and confirm whether it is version 8.x or 9.x below the fixed versions.8.6.106 or later.9.10.5-alpha.7 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.
This page as .md · .json · in your agent: get_signal("CVE-2026-119126")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.