CVE-2026-63421: Keystone vulnerable to `graphql.maxTake` bypass with negative `take`
The value of graphql.maxTake can be bypassed by providing a negative input.
This can be used to exceed the developer’s intended graphql.maxTake value, allowing queries to return results in excess of the graphql.maxTake value set.
References
- github.com/advisories/GHSA-cqmq-8755-7xvh
- github.com/keystonejs/keystone/commit/9fb88b246950ce4de754a43fe6416f20403577b1
- github.com/keystonejs/keystone/pull/9859
- github.com/keystonejs/keystone/releases/tag/@keystone-6/core@6.5.3
- github.com/keystonejs/keystone/security/advisories/GHSA-cqmq-8755-7xvh
- nvd.nist.gov/vuln/detail/CVE-2026-63421
Code Behaviors & Features
Detect and mitigate CVE-2026-63421 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →