{"id":"CVE-2026-63421","aliases":["GHSA-cqmq-8755-7xvh"],"url":"https://o3.security/vulnerability/CVE-2026-63421","summary":"Keystone: `graphql.maxTake` bypass with negative `take`","details":"# Summary\nThe value of `graphql.maxTake` can be bypassed by providing a negative input.\nThis can be used to exceed the developer's intended `graphql.maxTake` value, allowing queries to return results in excess of the `graphql.maxTake` value set.\n\n# Impact\nThis affects any project relying on `graphql.maxTake` to bound the number of items returned per query.\n\n# Patches\nThis issue has been patched in `@keystone-6/core` version `6.5.3`.\n\nIf you cannot patch, you can workaround this by restricting `take` input values in your GraphQL queries to the bounded value, or by blocking negative values.\n\n# Credit\nThis issue was found by [Haxset's](https://haxset.com) Security Scanner and validated by their team.","published":"2026-08-21T20:15:16.459Z","modified":"2026-09-11T03:30:54.861700364Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00469,"percentile":0.38627,"asOf":"2026-08-27"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@keystone-6/core","fixedVersion":"6.5.3"}],"fix":{"url":"https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1","label":"keystonejs/keystone@9fb88b2"},"references":[{"type":"WEB","url":"https://github.com/keystonejs/keystone/releases/tag/@keystone-6/core@6.5.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63421.json"},{"type":"ADVISORY","url":"https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63421"},{"type":"FIX","url":"https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1"},{"type":"FIX","url":"https://github.com/keystonejs/keystone/pull/9859"},{"type":"PACKAGE","url":"https://github.com/keystonejs/keystone"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-11T03:30:54.861700364Z"}}