CVE-2026-110854: Parse Server Denial of Service via Unhandled Email Error
Summary
CVE-2026-110854: Parse Server before 8.6.97 and 9.10.2 Denial of Service via Unhandled Email Error. Affects parse across 2 version ranges.
< 8.6.97
>= 9.0.0, < 9.10.2
Fixed in 8.6.97 or 9.10.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Parse Server is an open-source backend platform that enables developers to build applications quickly and efficiently. It provides features such as user authentication, data storage, and real-time notifications. However, certain versions of Parse Server are vulnerable to a Denial of Service (DoS) attack due to improper error handling when sending verification or password reset emails.
Vulnerability Detail
The vulnerability arises in Parse Server versions prior to 8.6.97 and 9.10.2, where the server fails to handle errors that occur during the email sending process. If a client with only public application keys requests a verification email or password reset while the mail provider is unavailable or rate-limited, the server process crashes. This can lead to service interruptions and potential exploitation by malicious users.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.6.978.6.97 -
>= 9.0.0, < 9.10.29.10.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing a retry mechanism for email sending or logging errors without crashing the server. This can help maintain service availability while you prepare for the update.
Conclusion
In summary, CVE-2026-110854 represents a significant vulnerability in Parse Server that can lead to Denial of Service due to unhandled email errors. It is crucial for users to update to the patched versions to ensure the stability and security of their applications.
See every vulnerability recorded for parse →
FAQ
Parse Server versions before 8.6.97 and 9.0.0 before 9.10.2 are affected.
The vulnerability can lead to a Denial of Service (DoS), causing the server to crash when email sending fails.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Implement a temporary workaround such as a retry mechanism for email sending to avoid server crashes.
More information can be found in the official vulnerability database or the GitHub repository for Parse Server.
References
Related vulnerabilities
Recent vulnerabilities recorded for parse.
