High
Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
Type: advisorySources: OSV
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-109954
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 6 Nov 2026, 02:14 UTC · Revision 1
Source evidence
Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference
core-osv · Original sourcePublished 13 Oct 2026, 13:27 UTC
Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.
osv:CVE-2026-109954
Complete source record
{
"id": "58acb85905d88d929120dd586f317a4f7232b5d788e1902326f6667a9ae7e39b",
"url": "https://osv.dev/vulnerability/CVE-2026-109954",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Parse Server 9.0.0 before 9.10.2-alpha.5 Transactional Batch Request Write Interference",
"summary": "Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.",
"evidence": "osv:CVE-2026-109954",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-109954",
"aliases": [
"BIT-parse-2026-109954",
"CVE-2026-109954",
"GHSA-jhh9-hrgh-c9gv"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/parse-community/parse-server",
"type": "GIT",
"events": [
{
"introduced": "532a461d30a6ed4457839f2caf5f30d5abf51a55"
},
{
"fixed": "1d0949cf88a80f391ff0ea74dd8ba894218284af"
},
{
"introduced": "9b34b0263bd4425fe3beedd0c687c08575eda190"
},
{
"fixed": "2005ac9219b66128d7f6789736be50a05de6dc7d"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "9.0.0"
},
{
"fixed": "9.10.2-alpha.5"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"introduced": "5.4.0"
},
{
"fixed": "8.6.96"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
}
],
"versions": [
"9.10.1",
"8.6.95",
"9.10.2-alpha.4",
"9.10.2-alpha.3",
"8.6.94",
"9.10.2-alpha.2",
"9.10.2-alpha.1",
"9.10.0",
"8.6.93",
"8.6.92",
"8.6.91",
"8.6.90",
"8.6.89",
"8.6.88",
"8.6.87",
"9.9.0",
"8.6.86",
"8.6.85",
"8.6.84",
"8.6.83",
"8.6.82",
"8.6.81",
"8.6.80",
"8.6.79",
"8.6.78",
"8.6.77",
"8.6.76",
"9.8.0",
"8.6.75",
"9.7.0",
"8.6.74",
"8.6.73",
"8.6.72",
"8.6.71",
"8.6.70",
"9.6.1",
"8.6.69",
"8.6.68",
"8.6.67",
"8.6.66",
"8.6.65",
"8.6.64",
"8.6.63",
"8.6.62",
"9.6.0",
"9.5.1",
"8.6.61",
"8.6.60",
"8.6.59",
"8.6.58",
"8.6.57",
"8.6.56",
"8.6.55",
"8.6.54",
"8.6.53",
"8.6.52",
"8.6.51",
"8.6.50",
"8.6.49",
"8.6.48",
"8.6.47",
"8.6.46",
"8.6.45",
"8.6.44",
"8.6.43",
"8.6.42",
"8.6.41",
"8.6.40",
"8.6.39",
"8.6.38",
"8.6.37",
"8.6.36",
"8.6.35",
"8.6.34",
"8.6.33",
"8.6.32",
"8.6.31",
"8.6.30",
"8.6.29",
"8.6.28",
"8.6.27",
"8.6.26",
"8.6.25",
"8.6.24",
"8.6.23",
"8.6.22",
"8.6.21",
"8.6.20",
"8.6.19",
"8.6.18",
"8.6.17",
"8.6.16",
"8.6.15",
"8.6.14",
"8.6.13",
"9.5.0",
"8.6.12",
"8.6.11",
"9.4.1",
"8.6.10",
"8.6.9",
"8.6.8",
"8.6.7",
"8.6.6",
"8.6.5",
"8.6.4",
"9.4.0",
"8.6.3",
"9.3.1",
"9.3.0",
"8.6.2",
"9.2.0",
"9.1.1",
"9.1.0",
"8.6.1",
"9.0.0",
"8.6.0",
"8.5.0",
"8.4.0",
"8.3.0",
"8.2.5",
"8.2.4",
"8.2.3",
"8.2.2",
"8.2.1",
"8.2.0",
"8.1.0",
"8.0.2",
"8.0.1",
"8.0.0",
"7.4.0",
"7.3.0",
"7.2.0",
"7.1.0",
"7.0.0",
"6.4.0",
"6.3.1",
"6.3.0",
"6.2.2",
"6.2.1",
"6.2.0",
"6.1.0",
"6.0.0",
"5.4.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-109954.json"
}
}
],
"modified": "2026-10-28T02:30:45.902515306Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109954.json",
"https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv",
"https://nvd.nist.gov/vuln/detail/CVE-2026-109954",
"https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.2-alpha.5-transactional-batch-request-write-interference"
],
"provider_metadata": {
"cwe_ids": [
"CWE-362"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109954.json"
}
},
"related_cves": [
{
"value": "CVE-2026-109954",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 514187,
"published_at": "2026-10-13T13:27:19.012+00:00"
}