{"id":"CVE-2026-121415","kind":"vulnerability","aliases":["CVE-2026-121415"],"related":[],"title":"Parse Server: null dot-notation keys bypass field type checks on MongoDB","description":"Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.","summary":"Parse Server on MongoDB skips field type validation for null-valued dot notation keys, so sub-documents can be written under Pointer, Number, String, Date, or Boolean fields. An attacker with write access can corrupt field values, make objects unreadable, or break atomic number operations.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mongodb","node.js","package","parse-server","self-hosted"],"not_affected_if":["managed-hosting-patched","no-public-writes","postgres-backend"],"how_to_check":"- Check the installed `parse` or `parse-server` version in `package.json` or `node_modules`, and compare it with the fixed versions below.\n- Confirm the database is MongoDB and whether public writes are allowed in Class-Level Permissions.","fix":"- Parse Server 8.x: upgrade to `8.6.111` or later\n- Parse Server 9.x: upgrade to `9.10.6-alpha.3` or later","status":"open","published_at":"2026-11-03T15:17:31+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","triaged_at":"2026-11-03T15:23:23+00:00","updated_at":"2026-11-03T15:23:23+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T15:23:23Z","model":"claude-haiku-5-5","output":{"fix":"- Parse Server 8.x: upgrade to `8.6.111` or later\n- Parse Server 9.x: upgrade to `9.10.6-alpha.3` or later","reach":"internet","title":"Parse Server: null dot-notation keys bypass field type checks on MongoDB","impact":"medium","summary":"Parse Server on MongoDB skips field type validation for null-valued dot notation keys, so sub-documents can be written under Pointer, Number, String, Date, or Boolean fields. An attacker with write access can corrupt field values, make objects unreadable, or break atomic number operations.","audience":"developers","category":"package","nicknames":[],"who_cares":["parse-server","mongodb","node.js","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker corrupts stored field values and breaks objects","analyst_note":"","how_to_check":"- Check the installed `parse` or `parse-server` version in `package.json` or `node_modules`, and compare it with the fixed versions below.\n- Confirm the database is MongoDB and whether public writes are allowed in Class-Level Permissions.","plain_action":"","needs_analyst":false,"not_affected_if":["postgres-backend","no-public-writes","managed-hosting-patched"],"who_is_affected":"Applications that run Parse Server on MongoDB and accept writes from clients, including unauthenticated clients where public writes are permitted. Deployments on other databases or with writes restricted to authenticated, trusted users are lower risk. Self-hosted and managed Parse apps should both be checked.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000721,"input_tokens":4233,"output_tokens":595,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121415':16A,19A '-2026':15A,18A '8.6.111':79C '9.0.0':81C '9.10.6':83C 'access':63B,117C 'allow':98C 'alpha.3':84C 'atom':73B,139C 'attack':60B 'beneath':105C 'boolean':57B,111C 'break':72B,138C 'bypass':8A 'check':11A 'client':114C,120C 'corrupt':65B,127C 'cve':14A,17A 'date':55B,109C,135C 'document':47B,101C 'dot':5A,41B,95C 'dot-not':4A 'field':9A,34B,58B,66B,88C,112C,128C,136C,143C 'host':28B 'includ':118C 'intern':134C 'key':7A,43B,97C 'make':68B,130C 'mongodb':13A,20B,32B,86C 'node.js':21B 'notat':6A,42B,96C 'null':3A,39B,93C 'null-valu':38B,92C 'number':53B,74B,107C,142C 'object':69B,131C 'oper':75B,140C 'packag':22B 'pars':1A,24B,29B,76C 'parse-serv':23B 'permit':125C 'pointer':52B,106C 'public':122C 'self':27B 'self-host':26B 'server':2A,25B,30B,77C 'skip':33B,87C 'string':54B,108C 'sub':46B,100C 'sub-docu':45B,99C 'type':10A,35B,89C 'unauthent':119C 'unread':70B,132C 'valid':36B,90C 'valu':40B,67B,94C,129C 'via':133C 'write':62B,116C,123C 'written':50B,104C","nicknames":[],"mitigations":[],"who_affected":"Applications that run Parse Server on MongoDB and accept writes from clients, including unauthenticated clients where public writes are permitted. Deployments on other databases or with writes restricted to authenticated, trusted users are lower risk. Self-hosted and managed Parse apps should both be checked.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","mongodb","nodejs","package","parseserver","selfhosted"],"first_public_at":"2026-10-19T19:34:53+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121415","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121415","severity":null,"published_at":"2026-11-03T15:17:31+00:00","modified_at":"2026-11-03T15:17:31+00:00","first_seen_at":"2026-11-03T15:21:58+00:00","fetched_at":"2026-11-03T15:21:58+00:00","note":null}],"documents":[{"id":58353,"url":"https://github.com/parse-community/parse-server/security/advisories/GHSA-655c-2xf3-77x9","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-19T19:34:53+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":58354,"url":"https://www.vulncheck.com/advisories/parse-server-before-8.6.111-and-9.0.0-before-9.10.6-alpha.3-field-corruption-via-null-dot-notation-key","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}