CVE-2026-119126 Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 afterSave Trigger and LiveQuery Bypass via Dot Notation Keys

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade...

CVE-2026-119126

Parse Server versions before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 are vulnerable to a flaw where the system mishandles dot notation keys containing null or undefined values during object construction. While the write operation is successfully stored, the system returns an error and skips after...