Is CVE-2026-121414 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-121414 being exploited in the wild.

How severe is CVE-2026-121414?

Medium severity, with a CVSS score of 5.9, published 3 November 2026.

Which products and versions are affected?

Parse Community Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2.

Is there a fix for CVE-2026-121414?

Yes: fixed in Parse Server 8.6.110, 9.10.6-alpha.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-121414 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-121414?

Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-121414: Parse Server denial of service via dot notation object update

CVE-2026-121414 · Severity: medium · CVSS 5.9 · Published 2026-11-03

Parse Server is a backend-as-a-service framework that handles application data and business logic. A flaw in how it processes object updates with dot notation keys can crash the Node.js process, causing a denial of service. Unauthenticated users can trigger this if the application allows public write access to objects.

Technologies: Parse Community Parse Server. Vendors: Parse Community.

Quick answers

Is CVE-2026-121414 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-121414 being exploited in the wild.
How severe is CVE-2026-121414?: Medium severity, with a CVSS score of 5.9, published 3 November 2026.
Which products and versions are affected?: Parse Community Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2.
Is there a fix for CVE-2026-121414?: Yes: fixed in Parse Server 8.6.110, 9.10.6-alpha.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-121414 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-121414?: Check whether you run Parse Community Parse Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Parse Server 8.6.110, 9.10.6-alpha.2

Technical details

The vulnerability occurs in object update handling when dot notation keys target a pointer field's object identifier on a class with an afterSave trigger, causing a serialization error that crashes the Node process. The attack requires no authentication if the target class has public write permissions, and is triggered via a malformed update request. Fixes skip vulnerable dot-notation writes and use safe serialization in trigger logging.

Affected products

Parse Community Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2

Timeline

2026-11-03: disclosed
2026-10-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.