---
id: CVE-2026-121415
title: >-
  Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 Field Corruption
  via Null Dot Notation Key
summary: >-
  Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips
  field type validation for null-valued dot notation keys, allowing
  sub-documents to be written beneath Pointer, Number, String, Date, or Boolean
  fields. Any clie…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-20
vendor: parse-community
product: parse-server
affected:
  - parse-server >= 9.0.0 < 9.10.6-alpha.3
  - parse-server < 8.6.111
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T14:28:13.739Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121415'
references:
  - url: >-
      https://github.com/parse-community/parse-server/security/advisories/GHSA-655c-2xf3-77x9
    label: GitHub Security Advisory (GHSA-655c-2xf3-77x9)
  - url: 'https://github.com/parse-community/parse-server/pull/10804'
  - url: 'https://github.com/parse-community/parse-server/pull/10805'
  - url: >-
      https://www.vulncheck.com/advisories/parse-server-before-8.6.111-and-9.0.0-before-9.10.6-alpha.3-field-corruption-via-null-dot-notation-key
    label: >-
      VulnCheck Advisory: Parse Server before 8.6.111 and 9.0.0 before
      9.10.6-alpha.3 Field Corruption via Null Dot Notation Key
tags:
  - cve.org
epss: 0.00366
epssPercentile: 0.30628
ingestedAt: '2026-11-05T19:30:42.964Z'
---

## Overview

Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot notation keys, allowing sub-documents to be written beneath Pointer, Number, String, Date, or Boolean fields. Any client with write access, including unauthenticated clients where public writes are permitted, can corrupt field values, make objects unreadable via internal date fields, or break atomic operations on number fields.

## Affected

- `parse-server >= 9.0.0 < 9.10.6-alpha.3`
- `parse-server < 8.6.111`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.