Parse Server uses a requestKeywordDenylist to block payloads containing disallowed keywords. Prior to versions 8.6.12 and 9.5.1‑alpha.1, the denylist logic stops scanning when it first encounters a nested object or array. As a result, an attacker can place a nested structure before a blocked keyword in the JSON request, causing the denylist to be bypassed. This flaw is a protection mechanism failure (CWE‑693) and undermines the integrity protection that developers rely on.

All parse‑community Parse Server deployments that run a version earlier than 8.6.12 or 9.5.1‑alpha.1 are affected. Because the requestKeywordDenylist is enabled by default, every installation that has not applied the patch is vulnerable. The software runs on any infrastructure that can host Node.js.

Based on the description, it is inferred that the attacker can exploit the vulnerability by sending a crafted JSON payload with a nested object or array that places a prohibited keyword after the nesting. The CVSS score of 6.9 denotes medium severity. The EPSS score of less than 1% indicates that exploitation has not been widely observed but still possible. The vulnerability is not listed in the CISA KEV catalog. If the API endpoints are reachable without authentication, an unauthenticated attacker may also use the bypass. The attack requires only network access to the Parse Server API and is straightforward to execute once the application is in use.