{"id":"CVE-2026-63762","title":"SurrealDB before v2.6.1 Denial of Service via scripting","summary":"SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to exec…","severity":"medium","cvss":6,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-476"],"vendor":"surrealdb","product":"surrealdb","affected":["surrealdb < 2.6.1","surrealdb < 3.0.0-beta.3"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-21T15:10:28.959578Z"},"published":"2026-07-20","updated":"2026-10-08","sourceUpdated":"2026-10-08T15:23:51.846Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63762","references":[{"url":"https://github.com/surrealdb/surrealdb/security/advisories/GHSA-xx7m-69ff-9crp","label":"GitHub Security Advisory (GHSA-xx7m-69ff-9crp)"},{"url":"https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-scripting","label":"VulnCheck Advisory: SurrealDB before v2.6.1 Denial of Service via scripting"},{"url":"https://github.com/surrealdb/surrealdb/pull/6774"},{"url":"https://github.com/surrealdb/surrealdb/pull/6833"},{"url":"https://github.com/surrealdb/surrealdb/commit/2b0389b92398d9ecff4632cd51bbf8303832a988"},{"url":"https://github.com/surrealdb/surrealdb/commit/bcd2ece9ef0d721215f06a47280698669f332285"},{"url":"https://github.com/surrealdb/surrealdb"}],"tags":["cve.org","osv","rust"],"epss":0.0045,"epssPercentile":0.38958,"aliases":["GHSA-xx7m-69ff-9crp"],"ecosystem":"rust","patched":["surrealdb 2.6.1","surrealdb 3.0.0-beta.3"],"ingestedAt":"2026-07-21T19:04:59.938Z","slug":"CVE-2026-63762","body":"## Overview\n\nSurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execute arbitrary queries — including unauthenticated guests when --allow-guests is enabled — can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown, requiring a manual restart. The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0.\n\n## Affected\n\n- `surrealdb < 2.6.1`\n- `surrealdb < 3.0.0-beta.3`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63762)\n\nAffected packages:\n\n- `surrealdb < 2.6.1`\n- `surrealdb >= 3.0.0-alpha.8, < 3.0.0-beta.3`\n\nPatched in:\n\n- `surrealdb 2.6.1`\n- `surrealdb 3.0.0-beta.3`\n\nSource: https://osv.dev/vulnerability/GHSA-xx7m-69ff-9crp","depth":"sunlit","depthScore":33,"depthScoreParts":{"impact":33,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":218207,"id":"CVE-2026-63762","ts":1791478559546,"field":"cvss","old":null,"new":"6"}]}