Executive brief
KeystoneJS is a headless CMS with a GraphQL API used to power content management systems. The API allows queries to traverse nested relationships (e.g., users → posts → author) without depth limits. An attacker can craft deeply nested queries that cause exponential growth in database operations, exhausting server resources and causing service outages for all users. This can be exploited without authentication if the API is publicly accessible.
Technical details
The vulnerability exists in KeystoneJS's GraphQL relationship field resolvers (packages/core/src/lib/core/queries/output-field.ts), which expose findMany queries on bidirectional relationships without enforcing depth limits or complexity analysis. The resolvers directly pass user-controlled arguments (where, take, skip, orderBy) to database operations. An attacker can construct a query like `users { posts { author { posts { author { ... } } } } }` where each nesting level executes independently for every parent result, creating exponential growth in database calls. Testing showed a depth-16 query on a 6-record SQLite database caused a 38-second hang. The attack requires no authentication if the GraphQL endpoint uses allowAll access (a common pattern). The fix, proposed in PR #9831, adds a configurable maxDepth option (defaulting to 20) using the graphql-depth-limit package as a validation rule in Apollo Server.
Affected products
- keystonejs @keystone-6/core up to 6.5.3
Timeline
- 2026-03-18: disclosed: Issue #9789 opened by researchers
- 2026-06-04: advisory: CVE-2026-10802 / GHSA-45jq-c8xm-jfw9 published
- 2026-05-02: other: Fix proposed in PR #9831, awaiting acceptance