CVE-2026-63421— Keystone: `graphql.maxTake` bypass with negative `take`
Quick assessment
Affected
keystonejs keystone
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Keystone 是一个基于 Node.js 的内容管理系统。在 6.5.3 版本之前， 文件中的 解析器直接将带符号的 参数与 进行比较，这使得远程未认证的 GraphQL 客户端可以提供负数的 值，其绝对值超过配置的上限。这种绕过方式同样适用于关联关系查询，可能导致返回的记录数超出开发者预期，从而可能耗尽服务资源。该问题已在 6.5.3 版本中修复。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1496 · Resource HijackingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| keystonejs | keystone | < 6.5.3 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-63421
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Keystone: `graphql.maxTake` bypass with negative `take`
Source: CVE Program / CVE List V5
Vulnerability Description
Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| keystonejs | keystone | < 6.5.3 | - |
|
II. Public POCs for CVE-2026-63421
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
Qwen3.6-35B-A3B
· 5941 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-63421
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-63421 (1)
Vendor Advisories for CVE-2026-63421 (1)
Vendor Pages for CVE-2026-63421 (1)
-
🔗 Release @keystone-6/core@6.5.3 · keystonejs/keystone · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: keystonejs
-
CVE-2026-10802
keystonejs keystone GraphQL API Endpoint output-field.ts res -
CVE-2026-33326
@keystone-6/core: `isFilterable` bypass via `cursor` paramet -
CVE-2025-46720
Keystone has an unintended `isFilterable` bypass that can be -
CVE-2023-40027
Conditionally missing authorization in @keystone-6/core -
CVE-2023-34247
@keystone-6/auth Open Redirect vulnerability
Same weakness: CWE-20
-
CVE-2026-59568
Remote Code Execution -
CVE-2026-75975
fast-uri vulnerable to server-side request forgery via malfo -
CVE-2026-7808
justhtml before 1.16.0 Multiple Security Issues via Sanitiza -
CVE-2026-5388
justhtml before 1.15.0 Multiple Security Issues -
CVE-2026-2996
Advanced Product Fields (Product Addons) for WooCommerce <=
V. Comments for CVE-2026-63421
No comments yet