CVE-2026-63421: 
JavaScript vulnerability analysis and mitigation

CVE-2026-63421 is a graphql.maxTake bypass vulnerability in KeystoneJS, a Node.js content management system, caused by improper input validation in the findMany resolver. By supplying a negative take argument whose absolute value exceeds the configured graphql.maxTake limit, an unauthenticated remote attacker can retrieve more records than the developer intended and potentially exhaust service resources. All versions of @keystone-6/core up to and including 6.5.2 are affected; the issue was fixed in version 6.5.3. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Feedly).

The root cause is a use of an incorrect comparison operator (CWE-480) combined with improper input validation (CWE-20) in packages/core/src/lib/core/queries/resolvers.ts. The vulnerable code compared the signed take argument directly against graphql.maxTake using (take ?? Infinity) > maxTake, which evaluates to false for any negative number, effectively bypassing the limit entirely. The fix replaces this with Math.abs(take ?? Infinity) > maxTake, ensuring the absolute value is checked. The bypass also applies to relationship queries (e.g., nested take arguments on related fields), and no authentication or special privileges are required to exploit it (Github Advisory, Patch Commit).

Successful exploitation primarily affects availability: an unauthenticated attacker can craft GraphQL queries with large negative take values to force the server to retrieve and return an unbounded number of database records, potentially exhausting memory, CPU, and database connection resources. This can lead to denial of service for all users of the affected Keystone application. There is no direct confidentiality or integrity impact, though returning more records than intended could expose data that developers assumed would be paginated and rate-limited (Github Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation at this time (Feedly). The vulnerability is trivially exploitable by any unauthenticated user with access to the GraphQL endpoint, requiring only a crafted query with a negative take value. The EPSS score is approximately 0.469% (39th percentile), indicating a relatively low but non-negligible probability of exploitation in the near term. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog (Github Advisory).

1. Identify target: Locate a publicly accessible KeystoneJS application running @keystone-6/core version 6.5.2 or earlier with a GraphQL endpoint (typically /api/graphql).
2. Enumerate available list types: Send an introspection query to the GraphQL endpoint to discover available list types and their fields (e.g., query { __schema { types { name } } }).
3. Craft malicious query: Construct a findMany-style query using a large negative take value whose absolute magnitude exceeds the configured graphql.maxTake limit, for example:

query {
  posts(take: -100000) {
    id
    title
    content
  }
}

4. Send the request: Submit the crafted query via HTTP POST to the GraphQL endpoint without any authentication headers.
5. Exploit relationship queries: Optionally, nest negative take arguments within relationship fields to amplify the data retrieval and resource exhaustion effect:

query {
  user(where: { id: "some-id" }) {
    posts(take: -100000) {
      id
    }
  }
}

6. Achieve denial of service: Repeat requests rapidly to exhaust server memory, CPU, or database connections, degrading or denying service to legitimate users (Github Advisory, Patch Commit).

• Network: High volume of HTTP POST requests to the GraphQL endpoint (e.g., /api/graphql) from a single or small set of IP addresses; requests containing take arguments with large negative integer values in the GraphQL query body.
• Logs: Application or web server access logs showing repeated GraphQL queries with take: -<large number> parameters; unusually high response sizes or response times for GraphQL queries; errors or timeouts from the database layer associated with unbounded result sets.
• Process/Resource: Sudden spikes in memory or CPU utilization on the Node.js process hosting Keystone; database connection pool exhaustion or slow query alerts triggered by queries returning abnormally large result sets.

Upgrade @keystone-6/core to version 6.5.3 or later, which fixes the comparison logic by applying Math.abs() to the take argument before comparing it against graphql.maxTake (Github Advisory, Release). If an immediate upgrade is not possible, apply one of the following workarounds:

• Add application-level validation to reject negative take values in GraphQL resolvers before they reach the findMany logic.
• Deploy a Web Application Firewall (WAF) rule to block GraphQL requests containing negative integer values in the take argument.
• Restrict access to the GraphQL endpoint to authenticated users or trusted IP ranges where feasible.

The vulnerability was discovered by Haxset's Security Scanner and validated by their team, with the advisory published by KeystoneJS maintainer emmatown on July 1, 2026 (Github Advisory). No significant broader media coverage or notable public researcher commentary beyond the official advisory has been identified at this time.