The vulnerability arises from Parse Server lacking error handling when an email operation for verification or password reset fails. The failure triggers an unhandled exception that terminates the Node.js process, leading to a denial of service. The impact is restricted to service availability; attacker gains no code execution or data disclosure. The weakness corresponds to CWE‑248.

Affected products are Parse Server from the parse‑community project. Versions before 8.6.97 and the 9.0.0 series before 9.10.2‑alpha.6 are impacted. Any deployment using these releases with public application keys and email verification enabled is vulnerable. Upgrades beyond those versions provide a fixed implementation that safely handles email errors.

The CVSS score of 8.2 indicates high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. Attackers can reach the affected code path remotely by sending a sign‑up, verification, or password‑reset request using only the public application key. If the mail provider rejects, rate limits, or is unavailable, the unhandled error causes the server to exit. The scenario requires no local privileges or exploitation of additional services, making the vulnerability accessible to any client with network access to the Parse Server endpoint.