CVE-2026-126392 · Package
NO FIX YET · SEE WHAT TO DO
Parse Server versions from 9.10.6-alpha.1 before 9.10.8-alpha.1 leak whether a field is stored in MongoDB. A client with write-only access can send dot-notation updates and infer field existence from whether the server returns an internal error or success.
first public Oct 29, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications running Parse Server in the affected range that let clients with write but not read access send updates. The exposure is limited to learning field existence, not reading values. Deployments on other versions, or with no client write access, can skip it.
Not affected if auth-required, default-config
Who cares mongodb, node, parse-server
npm ls parse-server and compare it to the fixed range.9.10.8-alpha.1 or later.Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows clients with write but not read access to learn whether fields are stored on MongoDB. Attackers can send updates with dot notation operations on top-level fields and observe internal server errors versus success responses to infer field existence.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.