CVE-2026-63421

Name of the Vulnerable Software and Affected Versions Keystone versions prior to 6.5.3

Description The findMany resolver in packages/core/src/lib/core/queries/resolvers.ts compares the signed take argument directly with graphql.maxTake. This allows a remote unauthenticated GraphQL client to provide a negative take value with a magnitude exceeding the configured bound. This bypass also affects relationship queries and can result in the return of more records than intended, potentially leading to the exhaustion of service resources.

Recommendations Update to version 6.5.3.