Parse Server allows clients to send queries that include $or, $and, and $nor operators. When these operators are deeply nested, the internal query‑traversal helper performs exponential‑time processing, blocking the Node.js event loop. The attacker can trigger this by constructing a query that exploits the nesting depth, which results in a denial of service. This weakness is classified as CWE‑407, an inefficient algorithmic complexity issue.

The affected product is Parse Server, an open‑source Node.js backend maintained by the parse-community. Versions prior to 9.9.1‑alpha.12 and 8.6.82 are vulnerable and require upgrading to at least those release points.

The CVSS score of 8.7 denotes high severity. The EPSS score of <1% indicates a very low likelihood of exploitation, yet the vulnerability can still be triggered remotely by sending a specially crafted query to a publicly exposed REST or LiveQuery endpoint, exhausting server resources by blocking the event loop. The vulnerability is not listed in the CISA KEV catalog, but that does not lessen its potential impact.