DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63421: CVE-2026-63421: Query Limit Bypass via Negative Integer Input in KeystoneJS core resolvers

#security #cve #cybersecurity

CVE-2026-63421: Query Limit Bypass via Negative Integer Input in KeystoneJS core resolvers

Vulnerability ID: CVE-2026-63421
CVSS Score: 7.5
Published: 2026-08-21

A high-severity vulnerability exists in KeystoneJS, a popular Node.js CMS and GraphQL framework, where the query resolution engine fails to validate signed negative integers within the pagination subsystem. Unauthenticated remote attackers can leverage this flaw to bypass the 'graphql.maxTake' safety boundary. By sending large negative values in the 'take' query parameter, the underlying Prisma ORM interprets the value as an instruction to fetch rows from the end of the collection, allowing malicious actors to bypass pagination limits, trigger database resource exhaustion, and execute application-level Denial of Service (DoS) attacks.

TL;DR

KeystoneJS prior to version 6.5.3 allows remote unauthenticated users to bypass configured database query limits (graphql.maxTake) by supplying negative integers to the 'take' parameter. This bypass forces the database to retrieve massive, unrestricted datasets, leading to severe resource exhaustion and system Denial of Service.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-20, CWE-480
  • Attack Vector: Network (AV:N)
  • CVSS Severity: 7.5 (High)
  • EPSS Score: 0.0009
  • Impact Category: Availability (High)
  • Exploit Status: poc
  • KEV Status: Not Listed

Affected Systems

  • KeystoneJS content management systems running @keystone-6/core versions prior to 6.5.3
  • Database applications backed by Prisma ORM integrated with vulnerable KeystoneJS query layers
  • @keystone-6/core: < 6.5.3 (Fixed in: 6.5.3)

Code Analysis

Commit: 9fb88b2

Fix enforcement of maxTake for negative take values

Exploit Details

  • GitHub: GHSA documentation outlining the Proof of Concept test payload for limits enforcement.

Mitigation Strategies

  • Upgrade @keystone-6/core to version 6.5.3 or higher to natively block negative limit bypasses.
  • Apply Web Application Firewall (WAF) regular expression rules to drop payloads referencing negative take parameters.
  • Deploy custom Express middleware to recursively sanitize and block negative values in incoming GraphQL variable inputs.
  • Set aggressive database query timeouts and resource allocation caps within Prisma and database systems.

Remediation Steps:

  1. Identify all KeystoneJS deployment instances and extract installed package version ranges.
  2. Execute npm install @keystone-6/core@6.5.3 or yarn upgrade @keystone-6/core@6.5.3 to apply the vendor-provided patch.
  3. Configure network-level or middleware-level input filtering for systems that cannot undergo immediate patching.
  4. Audit existing GraphQL schema configurations to ensure adequate rate limiting and query depth analysis are implemented.

References

Read the full report for CVE-2026-63421 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)