CVE-2026-121415

Parse Server versions before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 using MongoDB are vulnerable to field corruption. The root cause is that the server skips field type validation for null-valued dot notation keys , which allows an attacker to write sub-documents beneath existing Pointer, Number...