CVE-2026-109954: Parse Server Transactional Batch Request Write Interference Vulnerability
Summary
CVE-2026-109954: Parse Server 9.0.0 before 9.10.2 Transactional Batch Request Write Interference. Affects parse across 2 version ranges.
>= 5.4.0, < 8.6.96
>= 9.0.0, < 9.10.2
Fixed in 8.6.96 or 9.10.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that provides a robust framework for building applications. It allows developers to manage data, user authentication, and real-time notifications seamlessly. The platform is widely used for mobile and web applications due to its scalability and ease of integration with various databases. However, certain versions of Parse Server have a vulnerability that affects its transactional batch processing capabilities, potentially leading to data integrity issues.
Vulnerability Detail
The vulnerability arises from the way Parse Server handles transactional batch requests. In versions 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2, the server shares transactional batch state across concurrent requests. This means that if one client's batch request fails, it can interfere with other clients' database writes, leading to unintended rollbacks of acknowledged writes. This issue is particularly problematic in environments using PostgreSQL or MongoDB replica sets and sharded clusters, where transactions can remain open indefinitely, causing subsequent writes to fail and impacting overall application functionality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 5.4.0, < 8.6.968.6.96 -
>= 9.0.0, < 9.10.29.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider limiting the number of concurrent transactional batch requests or implementing a queuing mechanism to ensure that requests are processed sequentially. This can help mitigate the interference caused by concurrent requests until the package is updated.
Conclusion
The CVE-2026-109954 vulnerability in Parse Server presents significant risks related to transactional batch processing. It is crucial for users to update to the latest versions to mitigate these risks and ensure the integrity of their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for parse →
FAQ
CVE-2026-109954 is a vulnerability in Parse Server that allows transactional batch requests to interfere with each other, potentially causing data integrity issues.
Versions 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2 are affected by this vulnerability.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file like package-lock.json, you can check for vulnerabilities in real-time.
Failing to address this vulnerability can lead to data loss, inconsistent application behavior, and a poor user experience due to failed database writes.
You can update Parse Server by running 'npm install parse-server@latest' in your terminal to ensure you have the latest secure version.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
