A flaw in the GraphQL output-field component of keystonejs keystone allows an attacker to manipulate requests in a way that consumes server resources. The issue, identified as CWE-400 and CWE-404, can lead to sustained high CPU or memory usage, effectively interrupting normal service operation for legitimate users. The vulnerability does not grant code execution or data exfiltration but can disrupt availability for a targeted system.

The problem exists in the keystonejs keystone framework, specifically in the component handling GraphQL API requests, up to the version released on March 19, 2026. Any deployment of keystonejs keystone using these or earlier releases is potentially vulnerable. No specific sub‑versions are listed beyond the release date cutoff.

The CVSS score of 5.3 places this issue in the moderate severity range, and the EPSS score is currently unavailable, so no exploitation probability can be quantified. It is not listed in the CISA KEV catalog, yet public proof‑of‑concept code is available and the attack can be launched remotely by sending crafted GraphQL queries designed to exhaust server resources. Until a fix is applied, the risk remains moderate but could be elevated if the vulnerable endpoint is exposed to untrusted traffic.