Keystone: `graphql.maxTake` bypass with negative `take`
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| keystonejs | keystone | before 6.5.3 | 6.5.3 | Patch available | CNA |
| — | @keystone-6/core (npm) | before 6.5.3 | 6.5.3 | Patch available | GHSA-cqmq-8755-7xvh |
- keystone Vendorkeystonejs Affected before 6.5.3 Fixed in 6.5.3 Patch available CNA
- @keystone-6/core (npm) Vendor— Affected before 6.5.3 Fixed in 6.5.3 Patch available GHSA-cqmq-8755-7xvh
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:*:*:* | — | — | keystonejs |
- cpe:2.3:a:keystonejs:keystone:*:*:*:*:*:*:*:* Versions — — ·keystonejs
Remediation
- Fix · CNA keystone (keystonejs) Fixed in 6.5.3
- Fix · GHSA-cqmq-8755-7xvh @keystone-6/core (npm) Fixed in 6.5.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-63421
- 2026-10-03 Alias added: GHSA-cqmq-8755-7xvh
References
Other 5
- https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh
- https://github.com/keystonejs/keystone/pull/9859
- https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1
- https://github.com/keystonejs/keystone/releases/tag/@keystone-6/[email protected]
- https://github.com/keystonejs/keystone
More keystonejs vulnerabilities
- TI-2022-18756 NODE_ENV in Keystone defaults to development with esbuild CVSS 3.1CRITICAL 9.8
- TI-2022-18698 @keystone-6/core vulnerable to field-level access-control bypass for multiselect field CVSS 3.1CRITICAL 9.8
- TI-2026-09270 keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption CVSS 4.0MEDIUM 5.3
- TI-2017-11626 CSV Injection (aka Excel Macro Injection or Formula Injection) exists in… CVSS 3.0HIGH 8.8
- TI-2022-11852 An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1… CVSS 3.1CRITICAL 9.8
- TI-2017-12181 KeystoneJS before 4.0.0-beta.7 allows application-wide CSRF bypass by removing the CSRF… CVSS 3.0HIGH 8.8
Sources
- CVE-2026-63421 · CVE Program
- CVE-2026-63421 · NVD
- FIRST EPSS
- GHSA-cqmq-8755-7xvh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences