CVE-2026-110854 Parse Server before 8.6.97 and 9.10.2-alpha.6 Denial of Service via Unhandled Email Error
Attackers can crash the Parse Server by triggering unhandled email errors during user registration or password reset requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-110854?
CVE-2026-110854 is a high-severity denial of service vulnerability in parse-community parse-server, published on 14 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails, causing the server process to exit. A client holding only the public application keys can sign up, request a verification email, or request a password reset while the mail provider rejects, rate limits, or is unavailable, crashing the server.
Weakness: CWE-248
Which versions are affected by CVE-2026-110854?
1 open source package ship an affected version, including parse.
| Package | Affected | Fixed in |
|---|---|---|
parse Bitnami | All versions | 8.6.97, 9.10.2 |
How do I fix CVE-2026-110854?
Upgrade parse to a fixed version for your release line: 8.6.97 or 9.10.2.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-110854 being exploited?
There is no known exploitation of CVE-2026-110854 in the wild and no public exploit code.
Sources
Also known as BIT-parse-2026-110854, GHSA-46jj-qw3p-48fc, GHSA-g2v6-w4hv-64wf.