---
id: CVE-2026-109338
title: >-
  SurrealDB before 3.3.0 contains a denial of service vulnerability that allows
  query-capable users to crash the server by reading non-ASCII header values in
  embedded JavaScript
summary: >-
  SurrealDB before 3.3.0 contains a denial of service vulnerability that allows
  query-capable users to crash the server by reading non-ASCII header values in
  embedded JavaScript. Attackers with scripting enabled can read such values via
  He…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
published: '2026-10-12'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T17:17:26.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109338'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-84w9-87hm-mxqx
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-denial-of-service-via-headers-non-ascii-values
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.00307
epssPercentile: 0.23319
ingestedAt: '2026-10-12T18:00:08.207Z'
vendor: surrealdb
product: surrealdb
affected:
  - surrealdb < 3.3.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-13T16:10:50.892434Z'
---

## Overview

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.