---
id: "CVE-2026-121415"
kind: "vulnerability"
aliases: ["CVE-2026-121415"]
title: "Parse Server: null dot-notation keys bypass field type checks on MongoDB"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["mongodb", "node.js", "package", "parse-server", "self-hosted"]
not_affected_if: ["managed-hosting-patched", "no-public-writes", "postgres-backend"]
published_at: "2026-11-03T15:17:31+00:00"
first_seen_at: "2026-11-03T15:21:58+00:00"
updated_at: "2026-11-03T15:23:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121415", "first_seen_at": "2026-11-03T15:21:58+00:00"}]
---

# Parse Server: null dot-notation keys bypass field type checks on MongoDB

Parse Server on MongoDB skips field type validation for null-valued dot notation keys, so sub-documents can be written under Pointer, Number, String, Date, or Boolean fields. An attacker with write access can corrupt field values, make objects unreadable, or break atomic number operations.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `parse` or `parse-server` version in `package.json` or `node_modules`, and compare it with the fixed versions below.
- Confirm the database is MongoDB and whether public writes are allowed in Class-Level Permissions.

## Fix

- Parse Server 8.x: upgrade to `8.6.111` or later
- Parse Server 9.x: upgrade to `9.10.6-alpha.3` or later

## Timeline

- 2026-11-03T15:21:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121415

## Documents

- [advisory] Vendor advisory: github.com https://github.com/parse-community/parse-server/security/advisories/GHSA-655c-2xf3-77x9
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/parse-server-before-8.6.111-and-9.0.0-before-9.10.6-alpha.3-field-corruption-via-null-dot-notation-key

## From the sources

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_