{"id":"CVE-2026-119126","kind":"vulnerability","aliases":["CVE-2026-119126"],"related":[],"title":"Parse Server: dot-notation null writes skip afterSave triggers and LiveQuery","description":"Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade audit logging, notifications, and derived data updates.","summary":"Parse Server stores a write with dot-notation keys set to null or undefined but returns an error to the client. The save skips afterSave triggers and LiveQuery events, so a client with write access can bypass audit logging, notifications and derived data updates.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backend","node.js","package","parse-server","self-hosted"],"not_affected_if":["no-aftersave-triggers","no-livequery","patched-version"],"how_to_check":"- Check the installed Parse Server version with `npm ls parse-server` in the server project.\n- Look for the `parse-server` dependency in package.json and confirm whether it is version `8.x` or `9.x` below the fixed versions.","fix":"- Parse Server 8: move to `8.6.106` or later.\n- Parse Server 9: move to `9.10.5-alpha.7` or later.","status":"open","published_at":"2026-10-29T16:18:05+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","triaged_at":"2026-10-29T16:32:06+00:00","updated_at":"2026-10-29T16:32:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:32:06Z","model":"claude-haiku-5-5","output":{"fix":"- Parse Server 8: move to `8.6.106` or later.\n- Parse Server 9: move to `9.10.5-alpha.7` or later.","reach":"network","title":"Parse Server: dot-notation null writes skip afterSave triggers and LiveQuery","impact":"low","summary":"Parse Server stores a write with dot-notation keys set to null or undefined but returns an error to the client. The save skips afterSave triggers and LiveQuery events, so a client with write access can bypass audit logging, notifications and derived data updates.","audience":"businesses","category":"package","nicknames":[],"who_cares":["parse-server","node.js","self-hosted","backend"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"audit, notification and derived-data hooks silently skipped on writes","analyst_note":"","how_to_check":"- Check the installed Parse Server version with `npm ls parse-server` in the server project.\n- Look for the `parse-server` dependency in package.json and confirm whether it is version `8.x` or `9.x` below the fixed versions.","plain_action":"","needs_analyst":false,"not_affected_if":["patched-version","no-aftersave-triggers","no-liveQuery"],"who_is_affected":"Applications that run Parse Server 8 before 8.6.106 or 9 before 9.10.5-alpha.7 and let clients write objects with dot-notation keys. The impact is limited to triggers and audit or notification logic that depends on afterSave or LiveQuery, so teams with no such hooks have less at stake. Teams that run only read-only clients or do not use these hooks can deprioritise it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000719,"input_tokens":4157,"output_tokens":607,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-119126':15A,18A '-2026':14A,17A '8.6.106':76C '9.0.0':78C '9.10.5':80C 'access':63B,116C 'aftersav':9A,53B,107C 'alpha.7':81C 'audit':66B,122C 'backend':19B 'build':92C 'bypass':65B 'client':49B,60B,113C 'cve':13A,16A 'data':71B,127C 'deriv':70B,126C 'dot':4A,35B,83C 'dot-not':3A,34B 'error':46B,104C 'evad':121C 'event':57B,111C 'exploit':118C 'host':27B 'key':37B,85C 'livequeri':12A,56B,110C 'log':67B,123C 'mishandl':82C 'node.js':20B 'notat':5A,36B,84C 'notif':68B,124C 'null':6A,40B,87C 'object':95C 'packag':21B 'pars':1A,23B,28B,73C 'parse-serv':22B 'return':44B,102C 'save':51B,94C 'self':26B 'self-host':25B 'server':2A,24B,29B,74C 'set':38B 'skip':8A,52B,106C 'store':30B,100C 'trigger':10A,54B,108C 'undefin':42B,89C 'updat':72B,128C 'valu':90C 'write':7A,32B,62B,98C,115C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Parse Server 8 before 8.6.106 or 9 before 9.10.5-alpha.7 and let clients write objects with dot-notation keys. The impact is limited to triggers and audit or notification logic that depends on afterSave or LiveQuery, so teams with no such hooks have less at stake. Teams that run only read-only clients or do not use these hooks can deprioritise it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119126","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119126","severity":null,"published_at":"2026-10-29T16:18:05+00:00","modified_at":"2026-10-29T16:18:05+00:00","first_seen_at":"2026-10-29T16:25:58+00:00","fetched_at":"2026-10-29T16:25:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}