Improper Validation of Specified Quantity in Input Affecting parse-server package, versions >=9.0.0 <9.10.6-alpha.3<8.6.111
Threat Intelligence
The probability is the direct output of the EPSS model, and conveys an overall sense of the threat of exploitation in the wild. The percentile measures the EPSS probability relative to all known EPSS scores. Note: This data is updated daily, relying on the latest available EPSS model version. Check out the EPSS documentation for more details.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-PARSESERVER-22220115
- published5 Nov 2026
- disclosed3 Nov 2026
- creditUnknown
Introduced: 3 Nov 2026
NewCVE-2026-121415 (opens in a new tab)How to fix?
Upgrade parse-server to version 9.10.6-alpha.3, 8.6.111 or higher.
Overview
parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js.
Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via field type validation in SchemaController.js when processing object writes that use a dot notation key with a null value beneath a field that is not an object or array (such as a Pointer, Number, String, Date, or Boolean field) on MongoDB. The validation is skipped because a null value produces no type, allowing a sub-document to be written beneath the field and corrupting its stored value. An attacker with write access can corrupt field values, make objects permanently unreadable by corrupting internal date fields, or break atomic operations on number fields. PostgreSQL is not affected, as such writes are rejected at the database level.
Note: This is only exploitable on MongoDB backends where a client has write access to an object, including unauthenticated clients where the class or object permits public writes.
Workaround
Applications can reject such keys in a beforeSave trigger by validating incoming field names, or restrict write access through class-level permissions and ACLs.