CVE-2026-63421: Keystone CMS DOS Vulnerability

CVE-2026-63421 Overview

CVE-2026-63421 is a GraphQL API vulnerability in Keystone, a content management system for Node.js. The findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly against graphql.maxTake. A remote unauthenticated GraphQL client can supply a negative take value whose absolute magnitude exceeds the configured bound. The bypass also applies to relationship queries and returns more records than the developer intended. This behavior can exhaust service resources and cause denial of service. Keystone version 6.5.3 resolves the issue.

Critical Impact
Unauthenticated network attackers can bypass the maxTake limit and force the GraphQL API to return unbounded record sets, exhausting backend and application resources.

Affected Products

Keystone (@keystone-6/core) versions prior to 6.5.3
GraphQL findMany resolver in packages/core/src/lib/core/queries/resolvers.ts
Relationship queries derived from the same resolver logic

Discovery Timeline

2026-08-21 - CVE-2026-63421 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-63421

Vulnerability Analysis

The vulnerability is an input validation flaw ([CWE-20]) in Keystone's GraphQL query layer. The findMany resolver reads the client-supplied take argument and compares it directly to the configured maxTake upper bound. Because take is a signed integer, a negative value passes the greater-than check even when its magnitude exceeds maxTake. Prisma interprets negative take values as "take from the end," so the underlying database query still returns up to |take| rows. An unauthenticated attacker can therefore request record counts far beyond the intended cap through both top-level list queries and nested relationship queries.

Root Cause

The comparison (take ?? Infinity) > maxTake does not normalize sign before enforcement. A negative take (for example, -100000) is always less than any positive maxTake, so the guard never triggers. The Prisma layer then honors the negative value and returns the corresponding row count, defeating the intended query size limit.

Attack Vector

An unauthenticated remote client sends a GraphQL query to the Keystone API and supplies a large negative take value. The resolver skips the limit check and forwards the query. The database returns a large result set, and the process must serialize and transmit each record. Repeated queries drive CPU, memory, and I/O consumption until the service degrades or becomes unavailable.

typescript

   extraFilter?: PrismaFilter
 ): Promise<BaseItem[]> {
   const maxTake = (list.graphql.types.findManyArgs.take.defaultValue ?? Infinity) as number
-  if ((take ?? Infinity) > maxTake) {
+  if (Math.abs(take ?? Infinity) > maxTake) {
     throw limitsExceededError({ list: list.listKey, type: 'maxTake', limit: maxTake })
   }

Source: Keystone commit 9fb88b2. The patch wraps take with Math.abs() so that negative magnitudes are evaluated against maxTake.

Detection Methods for CVE-2026-63421

Indicators of Compromise

GraphQL requests containing take arguments with large negative values (for example, take: -10000) against findMany or relationship fields.
Spikes in Keystone API response sizes, response latency, or memory usage tied to specific GraphQL operations.
Repeated queries from a single client returning result sets larger than the documented graphql.maxTake bound.

Detection Strategies

Log and parse inbound GraphQL query bodies at the reverse proxy or API gateway, and alert on take values below zero.
Add server-side telemetry to record the row count returned by findMany resolvers and flag results exceeding maxTake.
Correlate database query duration and row counts with GraphQL operation names to surface anomalous list retrievals.

Monitoring Recommendations

Track Keystone process CPU, memory, and event-loop lag to detect resource exhaustion patterns.
Monitor Prisma query logs for high-cardinality SELECT statements originating from GraphQL resolvers.
Baseline normal GraphQL request rates per client IP and alert on sustained anomalous spikes.

How to Mitigate CVE-2026-63421

Immediate Actions Required

Upgrade @keystone-6/core to version 6.5.3 or later on all Keystone deployments.
Audit application logs for prior GraphQL requests using negative take values.
Place rate limiting and request-size controls in front of any internet-exposed Keystone GraphQL endpoint.

Patch Information

The fix is available in @keystone-6/core@6.5.3. Review the GitHub Security Advisory GHSA-cqmq-8755-7xvh, the pull request discussion, and the release notes for full remediation details.

Workarounds

If upgrading immediately is not possible, add a GraphQL middleware or query validator that rejects any operation where take is negative.
Enforce authentication and access control on GraphQL endpoints so unauthenticated clients cannot invoke findMany resolvers.
Apply per-client rate limiting and maximum response size limits at the reverse proxy layer.

bash

# Upgrade Keystone core to the patched release
npm install @keystone-6/core@6.5.3

# Verify installed version
npm ls @keystone-6/core