GHSA-45jq-c8xm-jfw9

Suggest an improvement
Source
https://github.com/advisories/GHSA-45jq-c8xm-jfw9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-45jq-c8xm-jfw9/GHSA-45jq-c8xm-jfw9.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-45jq-c8xm-jfw9
Aliases
  • CVE-2026-10802
Published
2026-06-04T12:30:26Z
Modified
2026-07-14T21:11:43Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Keystone: GraphQL API Endpoint Lacks Query Depth Limits
Details

A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.

Database specific 
{
    "cwe_ids":  [
        "CWE-400"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-14T20:53:52Z",
    "nvd_published_at":  "2026-06-04T12:16:24Z",
    "severity":  "LOW"
}
References

Affected packages

npm / @keystone-6/core

Package

Name
@keystone-6/core
View open source insights on deps.dev
Purl
pkg:npm/%40keystone-6/core

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
6.5.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-45jq-c8xm-jfw9/GHSA-45jq-c8xm-jfw9.json"