CVE-2026-63421: Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
The value of graphql.maxTake can be bypassed by providing a negative input.
This can be used to exceed the developer’s intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set.
References
- github.com/advisories/GHSA-cqmq-8755-7xvh
- github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1
- github.com/keystonejs/keystone/pull/9859
- github.com/keystonejs/keystone/releases/tag/@keystone-6/core@6.5.3
- github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh
- nvd.nist.gov/vuln/detail/CVE-2026-63421
Code Behaviors & Features
Detect and mitigate CVE-2026-63421 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →