This vulnerability in keystonejs keystone up to version 20260319 affects the GraphQL API Endpoint component, specifically in the file packages/core/src/lib/core/queries/output-field.ts. It allows remote attackers to cause resource consumption, potentially leading to denial of service or degraded performance. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with an attack vector of network, low attack complexity, no privileges required, and no user interaction. Although an exploit is public, the official fix has not yet been merged or released.

Successful exploitation results in resource consumption on the affected system, which may degrade performance or cause denial of service conditions. There is no indication of privilege escalation, data disclosure, or integrity impact. The vulnerability can be triggered remotely without authentication.

Patch status is not yet confirmed as the fix is pending acceptance of a pull request. Users should monitor the official keystonejs repository and advisories for the release of an official fix. Until then, consider implementing rate limiting or other resource usage controls on the GraphQL API endpoint to mitigate potential impact.