An attacker can send an unauthenticated HTTP request containing a deeply nested query with logical operators to the Parse Server API. The malformed query bypasses the pre‑validation transform pipeline, causing the server to enter a permanent hang state. The Parse Server process becomes unresponsive and must be manually restarted, resulting in a complete service outage. This vulnerability is a direct bypass of a previous fix (CVE-2026-32944) and therefore represents a critical availability flaw.

The vulnerability impacts the open‑source Parse Platform. Specifically, any deployment of parse‑server before version 8.6.55 or before 9.6.0‑alpha.44 is affected. Users running older 8.x or 9.x releases on Node.js environments are susceptible. The vulnerability applies to all editions of the product, regardless of configuration, as the trigger is an unauthenticated HTTP request.

The CVSS score of 8.7 indicates a high severity due to the impact on availability and the lack of authentication required. The EPSS score of less than 1% suggests that, while the exploit probability is low, the vulnerability can still be leveraged in targeted attacks. The issue is not listed in the CISA KEV catalog, meaning there is no publicly known active exploitation. Attackers would need network access to the Parse Server endpoint and would craft a request with a highly nested query to produce the hang.