CVE-2026-63421

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.

• CWE-20
• CWE-480

• https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1
• https://github.com/keystonejs/keystone/pull/9859
• https://github.com/keystonejs/keystone/releases/tag/@keystone-6/core@6.5.3
• https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh

Published

Aug 21, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63404Faktory is a language-agnostic background job server. In ver…7.3
• CVE-2026-63407Grav API Plugin is a RESTful API for Grav CMS that provides …8.2
• CVE-2026-63408Grav API Plugin is a RESTful API for Grav CMS that provides …7.5
• CVE-2026-63409Deskflow is a keyboard and mouse sharing app. From 1.17.0 un…8.2
• CVE-2026-6341Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 …4.3
• CVE-2026-6342Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 …4.3
• CVE-2026-63423During an internal security assessment, a potential vulnerab…7.8
• CVE-2026-63424During an internal security assessment, an improperly protec…7.3
• CVE-2026-63425During an internal security assessment, a potential improper…7.8
• CVE-2026-63426During an internal security assessment, a potential vulnerab…7.1
• CVE-2026-63428HeyForm is an open-source form builder. Prior to version 3.0…5.8
• CVE-2026-63429HeyForm is an open-source form builder. Prior to version 3.0…8.6