Is CVE-2026-109954 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-109954 being exploited in the wild.

How severe is CVE-2026-109954?

Medium severity, with a CVSS score of 6.5, published 13 October 2026.

Which products and versions are affected?

Parse Community Parse Server 5.4.0 before 8.6.96; 9.0.0 before 9.10.2-alpha.5.

How is CVE-2026-109954 attacked?

It is attacked over the network.

Am I affected by CVE-2026-109954?

Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-109954: Parse Server transactional batch state sharing across requests

CVE-2026-109954 · Severity: medium · CVSS 6.5 · Published 2026-10-13

Parse Server, a backend framework used to build scalable applications, inadvertently shares transactional batch state across concurrent client requests. An attacker can send a crafted batch request that interferes with other clients' database writes, causing legitimate writes to be rolled back or database connections to hang indefinitely, leading to availability disruptions and data inconsistency.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-109954 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-109954 being exploited in the wild.
How severe is CVE-2026-109954?: Medium severity, with a CVSS score of 6.5, published 13 October 2026.
Which products and versions are affected?: Parse Community Parse Server 5.4.0 before 8.6.96; 9.0.0 before 9.10.2-alpha.5.
Is there a fix for CVE-2026-109954?: Yes: fixed in Parse Server 8.6.96; 9.10.2-alpha.5. Until then: Set the Parse Server option masterKey to a string instead of a function, and do not register Cloud Code validators with rateLimit or set Parse.Server after the server has started. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-109954 attacked?: It is attacked over the network.
Am I affected by CVE-2026-109954?: Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Parse Server 8.6.96; 9.10.2-alpha.5

Set the Parse Server option masterKey to a string instead of a function, and do not register Cloud Code validators with rateLimit or set Parse.Server after the server has started.

Technical details

The vulnerability exists in Parse Server versions 5.4.0–8.6.96 and 9.0.0–9.10.2-alpha.5, where transactional batch state is not properly isolated per request. A client sending a transactional batch request on PostgreSQL, MongoDB replica sets, or sharded clusters can cause other clients' concurrent writes to be rolled back if the batch fails, or on PostgreSQL leave transactions open indefinitely, blocking subsequent writes. The attack requires no authentication and exploits a race condition when concurrent requests access the shared database controller.

Affected products

Parse Community Parse Server 5.4.0 before 8.6.96; 9.0.0 before 9.10.2-alpha.5

Timeline

2026-09-28: disclosed: GitHub security advisory GHSA-jhh9-hrgh-c9gv published
2026-10-13: advisory: CVE-2026-109954 published on NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.