# CVE-2026-110854: Parse Server unhandled email exception denial of service

Source: https://junglewise.ai/threats/cve-2026-110854-parse-server-before-8-6-97-and-9-0-0-before-9-10-2-alpha-6-does  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-110854 · Severity: info · Published 2026-10-14

Parse Server is a backend-as-a-service platform that handles user authentication and email communications for applications. When an email provider rejects, rate-limits, or becomes unavailable during verification or password reset email operations, the server crashes due to unhandled errors. An unauthenticated attacker can trigger this by requesting account verification or password reset, causing service outages.

Technologies: [Parse Community Parse Server](https://junglewise.ai/threats/technologies/parse-community-parse-server). Vendors: [Parse Community](https://junglewise.ai/threats/vendors/parse-community).

## Quick answers

**Is CVE-2026-110854 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-110854 being exploited in the wild.

**How severe is CVE-2026-110854?** Informational severity, published 14 October 2026.

**Which products and versions are affected?** Parse Community Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6.

**Is there a fix for CVE-2026-110854?** Yes: fixed in Parse Server 8.6.97, 9.10.2-alpha.6. Until then: Wrap the email adapter's send methods and sendUserEmailVerification function to catch and log errors instead of throwing or rejecting. Additionally, register a process.on('unhandledRejection', ...) listener in the application to log rejections and prevent process termination.</anigation>
<parameter name="attack_vector">["network"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-110854 attacked?** It is in a software library.

**Am I affected by CVE-2026-110854?** Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Parse Server 8.6.97, 9.10.2-alpha.6

Wrap the email adapter's send methods and sendUserEmailVerification function to catch and log errors instead of throwing or rejecting. Additionally, register a process.on('unhandledRejection', ...) listener in the application to log rejections and prevent process termination.</anigation>
<parameter name="attack_vector">["network"]

## Technical details

Parse Server fails to catch exceptions raised by email adapters when sending verification or password reset emails, allowing unhandled errors to terminate the process. The vulnerability affects deployments with email verification or password reset enabled, and requires no privileges or user interaction—any client with public application keys can trigger the crash via signup, verification email requests, or password reset requests when the mail provider is unavailable or rate-limiting. The fix wraps email sending operations in error handlers to log failures instead of crashing the process.

## Affected products

- Parse Community Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6

## Timeline

- 2026-09-30: disclosed: GitHub security advisory GHSA-46jj-qw3p-48fc published
- 2026-10-14: advisory: CVE-2026-110854 published

## References

- [https://github.com/parse-community/parse-server/security/advisories/GHSA-46jj-qw3p-48fc](https://github.com/parse-community/parse-server/security/advisories/GHSA-46jj-qw3p-48fc)
- [https://www.vulncheck.com/advisories/parse-server-before-8.6.97-and-9.10.2-alpha.6-denial-of-service-via-unhandled-email-error](https://www.vulncheck.com/advisories/parse-server-before-8.6.97-and-9.10.2-alpha.6-denial-of-service-via-unhandled-email-error)

## Related threats

- [Parse Server email validation regex denial of service](https://junglewise.ai/threats/cve-2026-123487-parse-server-before-8-6-115-and-9-0-0-before-9-10-7-alpha-1)
- [Parse Server prototype pollution in Cloud Code and LiveQuery](https://junglewise.ai/threats/cve-2026-121965-parse-server-before-8-6-113-and-9-0-0-before-9-10-6-alpha-5)
- [Parse Server denial of service via dot notation object update](https://junglewise.ai/threats/cve-2026-121414-parse-server-before-8-6-110-and-9-0-0-before-9-10-6-alpha-2)
- [Parse Server prototype pollution denial of service](https://junglewise.ai/threats/cve-2026-119569-parse-server-before-8-6-108-and-9-0-0-before-9-10-5-alpha-9)
- [Parse Server $relatedTo query ACL bypass](https://junglewise.ai/threats/cve-2026-116801-parse-server-before-8-6-105-and-9-0-0-before-9-10-5-alpha-6-does)