CVE-2026-63421
CVE-2026-63421 · Keystone: `graphql.maxTake` bypass with negative `take`
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.
CVSS 7.5 · Alta · EPSS 0,7% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node
Productos y versiones afectados
keystone
- Versiones
- < 6.5.3: Afectada
Sin corrección publicada
@keystone-6/core npm
- Intervalos de versiones afectados
- SEMVER: < 6.5.3
Actualiza a 6.5.3
Fuentes originales
- https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh
- https://github.com/keystonejs/keystone/pull/9859
- https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1
- https://github.com/keystonejs/keystone/releases/tag/@keystone-6/[email protected]
- https://nvd.nist.gov/vuln/detail/CVE-2026-63421