Description
A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| keystonejs | keystone | 20260319 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @keystone-6/core | <= 6.5.3 | — | GHSA-45jq-c8xm-jfw9 |
References
- VDB-368251 | keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption vdb-entry
- VDB-368251 | CTI Indicators (IOB, IOC, TTP, IOA) signature permissions-required
- CVE-2026-10802 | CVE Analysis and Report third-party-advisory
- Submit #831461 | Keystone KeystoneJS 2026-03-19 Denial of Service third-party-advisory
- https://github.com/keystonejs/keystone/issues/9789 issue-tracking
- https://github.com/keystonejs/keystone/pull/9831 issue-tracking patch
- https://gist.github.com/nedlir/0431275665076772844ebfe5167e54f6 exploit
- https://github.com/keystonejs/keystone/ product