CVE-2026-10802: Keystone GraphQL API Endpoint Lacks Query Depth Limits
Summary
CVE-2026-10802: Keystone: GraphQL API Endpoint Lacks Query Depth Limits. Affects @keystone-6/core versions < 6.5.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keystone is an open-source framework for building database-driven applications with a focus on GraphQL APIs. It provides developers with a powerful set of tools to create and manage data models, authentication, and permissions. The framework is widely used for its flexibility and ease of integration with various databases. However, a recent vulnerability has been identified in the GraphQL API endpoint, which could lead to excessive resource consumption.
Vulnerability Detail
A vulnerability was detected in the keystonejs package, specifically in the GraphQL API Endpoint. This issue arises from the lack of query depth limits, allowing attackers to craft deeply nested queries that can consume excessive server resources. This can lead to denial of service (DoS) conditions, where legitimate users may be unable to access the service due to resource exhaustion. The vulnerability affects versions of the package up to 6.5.3 and can be exploited remotely, making it a significant concern for applications using this framework.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can implement query depth limits in your GraphQL server configuration to mitigate the risk of resource exhaustion. For example, you can set a maximum query depth in your GraphQL schema definition as follows:
const { ApolloServer } = require('apollo-server');
const server = new ApolloServer({ typeDefs, resolvers, validationRules: [depthLimit(10)], });
This will limit the depth of queries to a maximum of 10.
Conclusion
The CVE-2026-10802 vulnerability in the Keystone framework's GraphQL API endpoint poses a risk of resource exhaustion due to the lack of query depth limits. It is crucial for developers to update to the patched version or implement workarounds to protect their applications from potential denial of service attacks.
See every vulnerability recorded for @keystone-6/core →
FAQ
CVE-2026-10802 is a vulnerability in the Keystone framework's GraphQL API endpoint that allows for excessive resource consumption due to a lack of query depth limits.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
The vulnerability can lead to denial of service (DoS) conditions, making the application unavailable to legitimate users due to resource exhaustion.
You can update the @keystone-6/core package by running the command: npm install @keystone-6/core@^6.5.4 in your terminal.
Yes, you can implement query depth limits in your GraphQL server configuration to reduce the risk of resource exhaustion.
References
Related vulnerabilities
Recent vulnerabilities recorded for @keystone-6/core.
