The vulnerability allows an attacker to send a specially crafted GraphQL query that triggers an exponential traversal of fragment spreads in the complexity validator. This leads to prolonged blocking of the Node.js event loop, causing a denial‑of‑service for all users on the affected server. The weakness is a form of excessive resource consumption, identified as CWE‑407.

The issue affects deployments of parse‑community's Parse Server running on Node.js that have the requestComplexity.graphQLDepth or requestComplexity.graphQLFields options enabled. Versions prior to 8.6.68 on the stable branch and before 9.7.0‑alpha.12 on the development branch are impacted. Upgrading to the patched releases removes the vulnerability.

The CVSS score of 8.2 indicates high severity, with a single unauthenticated request capable of shutting down service for seconds. EPSS data is unavailable, but because the flaw requires only a crafted payload over the public GraphQL endpoint, the likelihood of exploitation is significant. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but any exposed Parse Server instance that has the complexity validator enabled is at risk for denial of service.