Vulnerability · Published Jun 4, 2026 · Assigned by VulDB
CVE-2026-10802keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption
Medium 4.3
In plain English
A medium-severity uncontrolled resource consumption in keystone from keystonejs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).
Official description
A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @keystone-6/core | no fix listed | GHSA-45jq-c8xm-jfw9 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| keystonejs | keystone | 20260319 |
Weakness: CWE-400, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R
References
- VDB-368251 | keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption vdb-entry
- VDB-368251 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-10802 | CVE Analysis and Report third-party-advisory
- Submit #831461 | Keystone KeystoneJS 2026-03-19 Denial of Service third-party-advisory
- https://github.com/keystonejs/keystone/issues/9789 issue-tracking
- https://github.com/keystonejs/keystone/pull/9831 issue-tracking, patch
- https://gist.github.com/nedlir/0431275665076772844ebfe5167e54f6 exploit
- https://github.com/keystonejs/keystone/ product