Vulnerability · Published Oct 13, 2026 · Assigned by VulnCheck

CVE-2026-109954Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference

Medium 6.5

In plain English

A medium-severity race condition in parse-server from parse-community. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.2%top 87.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

Affected products (as reported)

Vendor	Product	Versions
parse-community	parse-server	9.0.0 – before 9.10.2-alpha.5
parse-community	parse-server	5.4.0 – before 8.6.96

Weakness: CWE-362 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H

References

GitHub Security Advisory (GHSA-jhh9-hrgh-c9gv) vendor-advisory
VulnCheck Advisory: Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference third-party-advisory