CVE-2026-63421

Keystone is a content management system for Node.js. Prior to 6.5.3, the findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake, allowing a remote unauthenticated GraphQL client to provide a negative take value whose magnitude exceeds the configured bound. The bypass also applies to relationship queries and can return more records than the developer intended, potentially exhausting service resources. This issue is fixed in version 6.5.3.

• CWE-20
• CWE-480

• https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1
• https://github.com/keystonejs/keystone/pull/9859
• https://github.com/keystonejs/keystone/releases/tag/@keystone-6/core@6.5.3
• https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh

Published

Aug 21, 2026

Last Modified

Oct 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63410secp256k1-native is a native C secp256k1 implementation for …5.9
• CVE-2026-63414Shopify App is a Rails engine for building Shopify applicati…7.6
• CVE-2026-63416draw.io is a configurable diagramming and whiteboarding appl…3.7
• CVE-2026-63419OpenImageIO is a toolset for reading, writing, and manipulat…7.8
• CVE-2026-6342Mattermost Plugins versions <=11.5 11.1.5 10.13.11 11.3.4.0 …4.3
• CVE-2026-63420OpenImageIO is a toolset for reading, writing, and manipulat…5.5
• CVE-2026-63422OpenImageIO is a toolset for reading, writing, and manipulat…7.8
• CVE-2026-63423During an internal security assessment, a potential vulnerab…7.8
• CVE-2026-63424During an internal security assessment, an improperly protec…7.3
• CVE-2026-63425During an internal security assessment, a potential improper…7.8
• CVE-2026-63426During an internal security assessment, a potential vulnerab…7.1
• CVE-2026-63427An authentication bypass vulnerability was discovered in Len…7.8