Live › vulnerability › CVE-2026-121414
Parse Server, a Node.js backend framework, fails to contain a serialization error when an object update uses a dot-notation key on a pointer field in a class that has an afterSave trigger. An attacker can send that update to crash the Node process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Applications that run Parse Server and define an afterSave trigger on a class with pointer fields. Exposure is highest where objects are writable without a session, since unauthenticated clients can then send the crashing update. Deployments that do not use afterSave triggers on such classes are less exposed.
No product ranges from the sources yet.
npm ls parse-server in the project.afterSave trigger whose objects accept writes from clients without a session.8.6.110 or later in the 8.x line.9.10.6-alpha.2 or later in the 9.x line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.
This page as .md · .json · in your agent: get_signal("CVE-2026-121414")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.