Live › vulnerability › CVE-2026-121415
Parse Server on MongoDB skips field type validation for null-valued dot notation keys, so sub-documents can be written under Pointer, Number, String, Date, or Boolean fields. An attacker with write access can corrupt field values, make objects unreadable, or break atomic number operations.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Applications that run Parse Server on MongoDB and accept writes from clients, including unauthenticated clients where public writes are permitted. Deployments on other databases or with writes restricted to authenticated, trusted users are lower risk. Self-hosted and managed Parse apps should both be checked.
No product ranges from the sources yet.
parse or parse-server version in package.json or node_modules, and compare it with the fixed versions below.8.6.111 or later9.10.6-alpha.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.
This page as .md · .json · in your agent: get_signal("CVE-2026-121415")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.