@keystone-6/core's bundled cuid package known to be insecure
Summary
The cuid package used by @keystone-6/* and upstream dependencies is deprecated and marked as insecure by the author.
As reported by the author
Cuid and other k-sortable and non-cryptographic ids (Ulid, ObjectId, KSUID, all UUIDs) are all insecure. Use @paralleldrive/cuid2 instead.
What are doing about this?
- We are waiting on Prisma to add support for
cuid2 - Alternatively, we might default to a random string ourselves
What can I do about this?
We have added a work-around for users who want to provide custom identifiers in https://github.com/keystonejs/keystone/pull/8645
What if I need a cuid?
The features marked as a security vulnerability by @paralleldrive are sometimes actually needed (as written in the README of cuid) - the problem is the inherent risks that features like this can have.
You might actually want the features of a monotonically increasing (auto-increment, k-sortable), and timestamp-based id as part of your application, and keystone should support that - but you might not want them by default. This is why this security advisory has been accepted by me (@dcousens), we currently use cuid identifiers by default, and that should change.
Impact
I have accepted this security advisory on the basis that we don't need this kind of identifier typically, and the need for them should be driven by an application's requirements, not a convenient default.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | @keystone-6/core | <= 5.3.1 | no fix |
References
- Weakness (CWE)
-- Platform
- npm
- Package
@keystone-6/core- Disclosed
- 12.06.2023
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-5fp6-4xw3-xqq3 - CC BY 4.0
Vulnerability history: @keystone-6/core
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 8
- First → latest
- 10.2022 08.2026
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 1
- Medium 2
- Low 3
Disclosures per year
- 2022: 2
- 2023: 2
- 2024: 0
- 2025: 1
- 2026: 3
-
@keystone-6/core's bundled cuid package known to be insecure this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.