{"id":"CVE-2026-63421","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-63421","summary":"Keystone vulnerable to `graphql.maxTake` bypass with negative `take`","details":"# Summary\nThe value of `graphql.maxTake` can be bypassed by providing a negative input.\nThis can be used to exceed the developer's intended `graphql.maxTake` value, allowing queries to return results in excess of the `graphql.maxTake` value set.\n\n# Impact\nThis affects any project relying on `graphql.maxTake` to bound the number of items returned per query.\n\n# Patches\nThis issue has been patched in `@keystone-6/core` version `6.5.3`.\n\nIf you cannot patch, you can workaround this by restricting `take` input values in your GraphQL queries to the bounded value, or by blocking negative values.\n\n# Credit\nThis issue was found by [Haxset's](https://haxset.com) Security Scanner and validated by their team.","published":"2026-08-21T20:55:11Z","modified":"2026-08-21T21:00:10.974905469Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"@keystone-6/core","fixedVersion":"6.5.3"}],"fix":{"url":"https://github.com/keystonejs/keystone/pull/9859","label":"keystonejs/keystone#9859"},"references":[{"type":"WEB","url":"https://github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh"},{"type":"WEB","url":"https://github.com/keystonejs/keystone/pull/9859"},{"type":"WEB","url":"https://github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1"},{"type":"PACKAGE","url":"https://github.com/keystonejs/keystone"},{"type":"WEB","url":"https://github.com/keystonejs/keystone/releases/tag/@keystone-6/core@6.5.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-21T21:00:10.974905469Z"}}