CVE-2026-63421: Query Limit Bypass via Negative Integer Input in KeystoneJS core resolvers

KeystoneJS is an extensible headless CMS and GraphQL API engine built on Node.js and TypeScript. Its core query resolution layer, exposed at public endpoints, handles incoming GraphQL abstract syntax trees and converts them into structured database operations. To prevent unauthorized resource consumption, KeystoneJS allows administrators to configure the maximum number of items returned by a single collection query using the graphql.maxTake setting. This architectural boundary functions as the primary security defense against database scraping and denial of service attacks.

The vulnerability exists because this safety parameter is improperly validated within the findMany resolver in the core routing engine. The attack surface is exposed directly through the public-facing /api/graphql endpoint, which is accessible to unauthenticated remote attackers by default. Because GraphQL clients can request nested collections within a single HTTP POST request, a failure to validate pagination constraints creates an opportunity for complex payload amplification.

The specific weakness corresponds to CWE-480 (Use of Incorrect Operator) combined with CWE-20 (Improper Input Validation). By exploiting this flaw, an attacker bypasses the safety limits of the query engine to execute high-resource database queries. This can lead to service performance degradation, application-level memory exhaustion, and eventual denial of service.

To understand the root cause, we must examine the validation logic of the query limit engine in packages/core/src/lib/core/queries/resolvers.ts. When a query is made, KeystoneJS extracts the take variable from the GraphQL arguments to specify the slice size of the requested collection. The application compares this user-supplied signed integer directly against the configured maxTake value to enforce resource boundaries.

The logical flaw lies in the inequality operation: if ((take ?? Infinity) > maxTake). In standard numeric logic, if maxTake is configured to 50 and the user provides a negative integer such as -1000, the comparison evaluates to -1000 > 50, which resolves to false. Because the condition is not met, the query validation subsystem assumes the input is within the allowed bounds and skips the limits validation error.

The application then passes this unvalidated negative parameter down to the database abstraction layer. Prisma ORM translates negative numbers into SQL instructions that query the dataset from the reverse direction. By supplying large negative numbers, an attacker forces the database to retrieve massive, unrestricted chunks of the dataset without triggering the application's rate-limiting logic.

The vulnerable code path prior to version 6.5.3 did not normalize incoming integers before running bounds comparison checks. The following code snippet shows the query parameter evaluation sequence in resolvers.ts:

// VULNERABLE: Direct comparison allows negative bypass
const maxTake = (list.graphql.types.findManyArgs.take.defaultValue ?? Infinity) as number;
if ((take ?? Infinity) > maxTake) {
  throw limitsExceededError({ list: list.listKey, type: 'maxTake', limit: maxTake });
}

The patch introduces the Math.abs helper function to enforce validation on the absolute value of the argument, ensuring that negative values are evaluated on their scale of magnitude:

// PATCHED: Absolute value normalizes signed integers
const maxTake = (list.graphql.types.findManyArgs.take.defaultValue ?? Infinity) as number;
if (Math.abs(take ?? Infinity) > maxTake) {
  throw limitsExceededError({ list: list.listKey, type: 'maxTake', limit: maxTake });
}

When Prisma receives the unpatched query with a take value of -100000, it generates an SQL query containing ORDER BY ... DESC LIMIT 100000. This statement forces the database engine to perform a full-table scan, load the matching keys, sort them in memory, and serialize the massive dataset into a JSON response. The Node.js event loop blocks while parsing this payload, stalling concurrent client requests and exhausting the V8 heap space.

Exploitation of CVE-2026-63421 requires only network-level access to the target application's GraphQL endpoint. The attacker does not need active session credentials or special administrative roles because the findMany resolver exposes standard query functionality. The attack payload is structured as a standard GraphQL query containing a negative take integer that exceeds the default pagination limit.

An attacker begins by issuing an introspection query or analyzing the schema to find valid collections and relationships. Once a collection name is identified, the attacker crafts a query requesting an extremely high number of records using a negative index value. For example, sending a query with take: -25000 causes the database to retrieve twenty-five thousand records from the end of the collection table.

The impact is compounded when attackers leverage nested relationship queries to trigger exponential database operations. In a nested exploit query, the attacker requests several high-level objects and specifies a high-magnitude negative take value for child tables. This creates a Cartesian product effect at the database level, exhausting the connection pool and causing memory starvation on the application server.

The security impact of this vulnerability is primarily classified as an Availability risk, carrying a CVSS v3.1 base score of 7.5. An unauthenticated attacker can render the entire application unavailable by repeatedly sending complex queries with massive negative offsets. The continuous processing of large SQL queries consumes high volumes of CPU cycles and memory, starving legitimate application processes.

Beyond Denial of Service, this bypass has significant implications for data confidentiality and scraping defense. Many production systems use query limiters to prevent automated scrapers from downloading entire databases. By exploiting the negative parameter bypass, malicious actors can systematically extract entire collections of sensitive records in reverse chronological order, bypassing the data export restrictions intended by developers.

If the server database has tens of thousands of users or private records, the lack of input sanitization allows adversaries to harvest bulk data. Because the Node.js runtime is single-threaded, a few concurrent requests of this nature are sufficient to cause complete CPU exhaustion on the event loop. The resulting thread starvation blocks all inbound traffic, resulting in a systemic collapse of the service.

The primary and recommended solution is to upgrade @keystone-6/core to version 6.5.3 or later. This upgrade modifies the resolver execution pipeline to use absolute value checks, preventing negative numbers from evading bounds validation. Security administrators can verify the update by ensuring that negative parameters now return the KS_LIMITS_EXCEEDED API response.

If updating the core package is not immediately possible, virtual patching must be applied at the network layer. Network firewalls or web application firewalls can block HTTP POST requests that match regex patterns detecting negative pagination. Organizations can enforce a WAF pattern that drops payloads matching the target regular expression to neutralize incoming malicious structures.

At the application level, developers can implement custom Express middleware to sanitize incoming GraphQL JSON payloads. This middleware recursively scans incoming POST requests for take parameters and rejects any transaction containing signed negative integers. Developers should also implement query complexity analysis and execution timeouts within the GraphQL server configuration to mitigate similar resource exhaustion vectors.