Denial of Service Vulnerability in SurrealDB by SurrealDB

CVE-2026-63762

What is CVE-2026-63762?

SurrealDB versions prior to v2.6.1 and v3.0.0-beta.3 are susceptible to a denial of service issue within its JavaScript scripting engine. When the --allow-scripting feature is enabled, and if the --allow-guests option is active, unauthenticated users can exploit this vulnerability. By crafting large strings with built-in functions and executing arbitrary queries, attackers can trigger a null pointer dereference in the QuickJS-NG engine. This results in an abrupt termination of the server process, necessitating a manual restart without prior graceful shutdown. The vulnerability was addressed by updating the rquickjs dependency from version 0.9.0 to 0.11.0.

References