An unauthenticated attacker can crash the Parse Server process, resulting in a total denial of service for all connected clients.

This vulnerability is caused by uncontrolled recursion (CWE-674) triggered by a single request containing deeply nested query condition operators. An unauthenticated attacker can exploit this to terminate the server process.

The vulnerability carries a CVSS score of 7.5, reflecting its high impact on service availability. Successful exploitation results in immediate service disruption, which can lead to significant operational downtime, loss of user connectivity, and potential impacts on business continuity for applications relying on the Parse Server backend.

Immediate Action: Upgrade to version 9.6.0-alpha.21 or 8.6.45 and explicitly configure the requestComplexity.queryDepth server option to limit recursion depth.

Proactive Monitoring: Monitor server logs for unexpected process crashes and sudden spikes in request complexity or malformed query patterns.

Compensating Controls: Implement rate limiting and request size restrictions at the Web Application Firewall or load balancer level to drop unusually complex or deeply nested JSON payloads before they reach the application.

Public Exploit Available: No

The risk posed by this vulnerability is significant due to the ease with which an unauthenticated attacker can disrupt core services. Administrators should prioritize patching Parse Server immediately and ensure that the requestComplexity.queryDepth mitigation is correctly implemented in their configuration, as the protection is not enabled by default after the update.