---
id: CVE-2026-109954
title: >-
  Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares
  transactional batch state across concurrent requests, letting any client's
  transactional batch request interfere with other clients' database writes
summary: >-
  Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares
  transactional batch state across concurrent requests, letting any client's
  transactional batch request interfere with other clients' database writes. On
  PostgreSQL o…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H'
cwe:
  - CWE-362
published: '2026-10-13'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:32.780'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109954'
references:
  - url: >-
      https://github.com/parse-community/parse-server/security/advisories/GHSA-jhh9-hrgh-c9gv
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/parse-server-9.0.0-before-9.10.2-alpha.5-transactional-batch-request-write-interference
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-13T14:29:01.854Z'
---

## Overview

Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any client's transactional batch request interfere with other clients' database writes. On PostgreSQL or MongoDB replica sets and sharded clusters, other clients' acknowledged writes are rolled back if the batch fails, and PostgreSQL transactions can remain open indefinitely, causing subsequent writes to fail.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.