Description

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-21T21:17:01.643Z",
  "pubdate": "2026-08-21T21:17:01.643Z",
  "executiveSummary": "Keystone prior to version 6.5.3 suffers from a boundary validation flaw within its GraphQL query resolution mechanism, specifically impacting the handling of the take argument. This vulnerability allows remote, unauthenticated attackers to supply a negative take value with a magnitude exceeding the configured graphql.maxTake limit.\nThe primary impact of this flaw is the potential circumvention of pagination restrictions, enabling malicious clients to query and retrieve an excessive number of records in a single request. This unauthorized data retrieval can lead to severe service resource exhaustion, database degradation, and denial of service conditions.\nThe affected product is Keystone (Node.js CMS) for versions prior to 6.5.3. Exploitation requires no prior authentication or elevated privileges, making it accessible to any external entity capable of interacting with the GraphQL endpoint exposed by the application.\nRisk implications are significant for deployments handling large datasets, as unconstrained queries can saturate memory and CPU resources. Remediation requires upgrading the Keystone core packages to version 6.5.3 or later, where proper validation logic for the signed take parameter has been correctly implemented.",
  "technicalDetails": "The root cause of the vulnerability resides in the findMany resolver located at packages/core/src/lib/core/queries/resolvers.ts within the Keystone codebase. Specifically, the function performs a flawed comparison by evaluating the signed take argument directly against the configured graphql.maxTake boundary without properly validating the absolute magnitude of negative integers.\nIn the vulnerable implementation, a remote unauthenticated GraphQL client can craft a payload containing a negative take parameter whose absolute value bypasses the intended upper bound checks. This logic flaw permits queries to override pagination constraints not only on standard collection queries but also across nested relationship queries managed by the Keystone ORM layer.\nThe attack flow begins when an external threat actor sends a malicious GraphQL query to the application endpoint over the network. The payload includes a specially crafted negative take argument. Because the input validation logic fails to correctly bound the magnitude of the signed integer, the query engine passes the unvalidated parameter to the underlying database query builder.\nUpon execution, the database interprets the request and returns a result set that drastically exceeds the developer-intended limits. The volume of data processed and transmitted back strains the Node.js event loop and consumes excessive database memory and connection pools.\nAffected versions include all Keystone installations prior to 6.5.3. The vulnerability requires network exposure of the GraphQL API endpoint, but no authentication tokens or specific user privileges are necessary to trigger the flaw. Post-exploitation impact primarily centers on resource exhaustion, leading to application instability or complete service unavailability."
}