CVE-2026-10802: keystonejs keystone Uncontrolled Resource Consumption
Vulnerability summary
CVE-2026-10802 is a medium (CVSS 5.3) Uncontrolled Resource Consumption vulnerability in keystonejs keystone. EPSS estimates a 0.31% chance of exploitation in the next 30 days, higher than 22.3% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 04-06-2026PublishedVulnerability first disclosed.
- 04-06-2026Last modifiedVulnerability information updated.
Description
A vulnerability was detected in keystonejs keystone up to 20260319. This vulnerability affects unknown code in the library packages/core/src/lib/core/queries/output-field.ts of the component GraphQL API Endpoint. The manipulation results in resource consumption. It is possible to launch the attack remotely. The exploit is now public and may be used. The pull request to fix this issue awaits acceptance.
CVSS metrics
9 scores · 3 sources · 4 versions- OSV · NpmEcosystem advisory · calculated5.3MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
- NVDNIST2.1LowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XDiffers
- OSV · NpmEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
- NVDNIST4.0MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
EPSS trend
Probability
0.31%
Chance of exploitation in the next 30 days
Percentile
22%
Versus all other CVEs
30-day change
0.00 pp
From 0.31% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 found0431275665076772844Ebfe5167E54F6
Maturity: poc
Weaknesses
CWE · root causeAffected systems
@keystone-61 product
- core≤ 6.5.3
Keystonejs1 product
- keystone20260319
2 vendors · 2 products
