Keystonejs Keystone vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Keystonejs Keystone: 3 record(s), with affected versions and fixes.cpe:2.3:a:keystonejs:keystone
CVE-2026-63421
High · 7.5
CWE-20 Aug 21, 2026
Keystone: `graphql.maxTake` bypass with negative `take`
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.
CVE-2026-10802
Medium · 4.3
CWE-400 Jun 4, 2026
keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
CVE-2026-33326
Medium · 4.3
CWE-863 Mar 24, 2026
@keystone-6/core: `isFilterable` bypass via `cursor` parameter in findMany
Keystone is a content management system for Node.js. Prior to version 6.5.2, {field}.isFilterable access control can be bypassed in findMany queries by passing a cursor. This can be used to confirm the existence of records by protected field values. The fix for CVE-2025-46720 (field-level isFilterable bypass for update and delete mutations) added checks to the where parameter in update and delete mutations however the cursor parameter in findMany was not patched and accepts the same UniqueWhere input type. This issue has been patched in version 6.5.2.