CVE-2026-109301 Overview
CVE-2026-109301 is a denial of service vulnerability in Parse Server affecting versions before 8.6.95 and 9.0.0 before 9.10.2-alpha.3. The server fails to resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery. This failure triggers an uncaught exception [CWE-248] that terminates the Node.js process.
Attackers with write access to a class that has Cloud Code save, find, or delete triggers or LiveQuery enabled can crash the server. The attack extends to unauthenticated users whenever public write access or user sign-up is permitted on the targeted class.
Critical Impact
An unauthenticated attacker can crash the Parse Server process or break subsequent requests by submitting a malformed file pointer, disrupting application availability.
Affected Products
- Parse Server versions prior to 8.6.95
- Parse Server 9.0.0 through versions prior to 9.10.2-alpha.3
- Applications exposing classes with Cloud Code triggers or LiveQuery and public write or sign-up enabled
Discovery Timeline
- 2026-10-12 - CVE-2026-109301 published to NVD
- 2026-10-16 - Last updated in NVD database
Technical Details for CVE-2026-109301
Vulnerability Analysis
Parse Server supports file references as object properties. These references are typically pointer objects carrying a URL that the server resolves before dispatching the object to Cloud Code triggers or LiveQuery subscribers. When a file pointer arrives without a URL field, the resolution step fails and raises an exception that is not caught by surrounding handlers.
Because the exception propagates to the Node.js event loop, the server process terminates. Any in-flight requests and LiveQuery subscriptions are severed. Repeated submissions keep the service unavailable, producing a persistent denial of service against the backend.
The vulnerability affects any class that invokes beforeSave, afterSave, beforeFind, afterFind, beforeDelete, or afterDelete Cloud Code hooks, as well as classes with LiveQuery enabled. The write operation itself is the trigger; the attacker does not need to read privileged data.
Root Cause
The root cause is an uncaught exception [CWE-248] in the file reference resolution path. Parse Server assumes every file pointer carries a URL and does not validate the presence of that field before invoking its resolver. Passing a malformed pointer to the resolver throws an error that bypasses the request-scoped error handling and reaches the process boundary.
Attack Vector
The attack vector is network-based and requires no authentication when the targeted class allows public writes or when user sign-up is enabled on the _User class. An attacker crafts a Parse SDK or REST write that includes a file-typed field with a pointer object missing the url property. The server accepts the write, attempts to pass the object to the configured trigger or LiveQuery pipeline, and crashes during pointer resolution. See the GitHub Security Advisory and the VulnCheck Advisory on Denial of Service for additional technical context.
Detection Methods for CVE-2026-109301
Indicators of Compromise
- Unexpected Node.js process terminations on the Parse Server host with stack traces referencing file pointer resolution
- Repeated HTTP write requests to classes with Cloud Code triggers that contain file-type fields missing the url property
- LiveQuery subscriber disconnects coincident with specific write operations from untrusted clients
Detection Strategies
- Inspect application logs for uncaught exception traces originating from Parse Server's file resolution modules immediately before process restart
- Monitor process supervisors such as pm2, systemd, or Kubernetes for frequent restarts of Parse Server containers
- Review request bodies against schema expectations to flag file fields that lack a resolvable URL
Monitoring Recommendations
- Alert on Parse Server process exit codes and container restart counts exceeding baseline frequency
- Capture a sample of write payloads at the ingress proxy to retain forensic evidence of malformed file pointers
- Track LiveQuery WebSocket drop rates and correlate with write traffic to identify abuse patterns
How to Mitigate CVE-2026-109301
Immediate Actions Required
- Upgrade Parse Server to version 8.6.95 or 9.10.2-alpha.3 or later as soon as possible
- Audit class-level permissions and remove public write access from classes that do not require it
- Disable open user sign-up on the _User class if business requirements allow
Patch Information
Parse Server maintainers released fixes in version 8.6.95 and in the 9.x branch starting at 9.10.2-alpha.3. The patched versions validate the presence of a URL on file pointers before invoking the resolver and surface a controlled error instead of an uncaught exception. Patch details are available in the GitHub Security Advisory.
Workarounds
- Add a beforeSave validation hook that rejects objects containing file fields without a populated url property
- Enforce class-level permissions that restrict write access to authenticated roles until upgrading
- Place a reverse proxy filter in front of Parse Server to reject requests whose JSON bodies include file pointer objects missing the url key
- Run Parse Server behind a process supervisor configured for rapid restart to reduce downtime while the patch is being deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
