GitHub Advisoryadvisory · npm
GHSA-45jq-c8xm-jfw9 Keystone: GraphQL API Endpoint Lacks Query Depth Limits
LOW
Official page ↗
- Aliases
- CVE-2026-10802
- Ecosystem
- npm
- Packages
- @keystone-6/core
- Severity
- Low
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- Weaknesses
- CWE-400
- Reviewed
- 2026-07-14
Affected packages
• npm @keystone-6/core: <= 6.5.3 (no fix yet)
Description
A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
Related
Alias · CVE (1)
- CVE-2026-10802 A vulnerability was detected in keystonejs keystone up to 20260319. vulnerability
Weakness · CWE (1)
- CWE-400 Uncontrolled Resource Consumption weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-10802 advisory
- https://github.com/keystonejs/keystone/issues/9789 web
- https://github.com/keystonejs/keystone/pull/9831 web
- https://gist.github.com/nedlir/0431275665076772844ebfe5167e54f6 web
- https://github.com/keystonejs/keystone package
- https://vuldb.com/cve/CVE-2026-10802 web
- https://vuldb.com/submit/831461 web
- https://vuldb.com/vuln/368251 web
- https://vuldb.com/vuln/368251/cti web