CVE-2026-10802: KeystoneJS Denial of Service via Unbounded GraphQL Query Depth

CVE-2026-10802 · Severity: medium · CVSS 4.3 · Published 2026-06-04

KeystoneJS is a headless CMS with a GraphQL API used to power content management systems. The API allows queries to traverse nested relationships (e.g., users → posts → author) without depth limits. An attacker can craft deeply nested queries that cause exponential growth in database operations, exhausting server resources and causing service outages for all users. This can be exploited without authentication if the API is publicly accessible.

Technologies: @keystone-6/core (npm). Vendors: npm.

Quick answers

Is CVE-2026-10802 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10802 being exploited in the wild.
How severe is CVE-2026-10802?
Medium severity, with a CVSS score of 4.3, published 4 June 2026.
Which products and versions are affected?
@keystone-6/core (npm) <= 6.5.3, SEMVER:introduced=0,last_affected=6.5.3.
Is there a fix for CVE-2026-10802?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-10802 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-10802?
Check whether you run @keystone-6/core (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in KeystoneJS's GraphQL relationship field resolvers (packages/core/src/lib/core/queries/output-field.ts), which expose findMany queries on bidirectional relationships without enforcing depth limits or complexity analysis. The resolvers directly pass user-controlled arguments (where, take, skip, orderBy) to database operations. An attacker can construct a query like `users { posts { author { posts { author { ... } } } } }` where each nesting level executes independently for every parent result, creating exponential growth in database calls. Testing showed a depth-16 query on a 6-record SQLite database caused a 38-second hang. The attack requires no authentication if the GraphQL endpoint uses allowAll access (a common pattern). The fix, proposed in PR #9831, adds a configurable maxDepth option (defaulting to 20) using the graphql-depth-limit package as a validation rule in Apollo Server.

Affected products

  • keystonejs @keystone-6/core up to 6.5.3

Identifiers

  • CVE-2026-10802
  • GHSA-45jq-c8xm-jfw9

Timeline

  • 2026-03-18: disclosed: Issue #9789 opened by researchers
  • 2026-06-04: advisory: CVE-2026-10802 / GHSA-45jq-c8xm-jfw9 published
  • 2026-05-02: other: Fix proposed in PR #9831, awaiting acceptance

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.