Parse Server’s GraphQL query complexity validator can be abused to provoke a denial‑of‑service when it receives a crafted query that contains binary fan‑out fragment spreads. Executing such a query blocks the Node.js event loop for several seconds, blocking all users of the backend. The flaw originates in the complexity calculation logic and is classified as a denial‑of‑service flaw.

Parse Server deployments built from the open‑source Parse Server project that run on Node.js are affected. Versions earlier than 8.6.68 and 9.7.0‑alpha.12 are vulnerable. Only installations that enable the requestComplexity.graphQLDepth or requestComplexity.graphQLFields configuration options are susceptible.

The vulnerability receives a CVSS score of 8.2, indicating a high severity level, while the EPSS score of less than 1 % suggests a low probability of exploitation. It is not listed in the CISA KEV catalog. An unauthenticated client can trigger the DoS by submitting a specially crafted GraphQL request to the exposed GraphQL endpoint; no authentication or privileged access is required. Once triggered, the event loop is forced to process an exponential number of fragment spreads, resulting in a temporary service outage for all users.