Threat database

CVE-2026-63421 is an improper input validation vulnerability in KeystoneJS prior to version 6.5.3. It allows a remote unauthenticated GraphQL client to provide a negative 'take' argument with a magnitude exceeding the configured maximum, bypassing intended query limits. This can lead to returning more records than intended, potentially exhausting service resources. The issue affects the findMany resolver and relationship queries. The vulnerability is fixed in KeystoneJS version 6.5.3.

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

CVE-2026-33326 is a medium severity vulnerability in KeystoneJS versions prior to 6.5.2 that allows bypassing access control on the isFilterable field during findMany queries by exploiting the cursor parameter. This flaw enables attackers with limited privileges to confirm the existence of records based on protected field values, potentially leaking sensitive information. The vulnerability stems from incomplete patching after a previous related issue (CVE-2025-46720) where update and delete mutations were fixed but the cursor parameter in findMany queries was overlooked. Exploitation requires network access and low privileges but no user interaction. The issue has been fixed in KeystoneJS version 6.5.2. Organizations using vulnerable versions should upgrade promptly to prevent unauthorized data exposure.