---
id: CVE-2026-63762
title: SurrealDB before v2.6.1 Denial of Service via scripting
summary: >-
  SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of
  service vulnerability in its embedded JavaScript scripting engine, which is
  enabled via the --allow-scripting capability (disabled by default). Any user
  able to exec…
severity: medium
cvss: 6
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'
cvssSource: cna
cwe:
  - CWE-476
vendor: surrealdb
product: surrealdb
affected:
  - surrealdb < 2.6.1
  - surrealdb < 3.0.0-beta.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-21T15:10:28.959578Z'
published: '2026-07-20'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T15:23:51.846Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-63762'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-xx7m-69ff-9crp
    label: GitHub Security Advisory (GHSA-xx7m-69ff-9crp)
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-scripting
    label: >-
      VulnCheck Advisory: SurrealDB before v2.6.1 Denial of Service via
      scripting
  - url: 'https://github.com/surrealdb/surrealdb/pull/6774'
  - url: 'https://github.com/surrealdb/surrealdb/pull/6833'
  - url: >-
      https://github.com/surrealdb/surrealdb/commit/2b0389b92398d9ecff4632cd51bbf8303832a988
  - url: >-
      https://github.com/surrealdb/surrealdb/commit/bcd2ece9ef0d721215f06a47280698669f332285
  - url: 'https://github.com/surrealdb/surrealdb'
tags:
  - cve.org
  - osv
  - rust
epss: 0.0045
epssPercentile: 0.38958
aliases:
  - GHSA-xx7m-69ff-9crp
ecosystem: rust
patched:
  - surrealdb 2.6.1
  - surrealdb 3.0.0-beta.3
ingestedAt: '2026-07-21T19:04:59.938Z'
---

## Overview

SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execute arbitrary queries — including unauthenticated guests when --allow-guests is enabled — can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown, requiring a manual restart. The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0.

## Affected

- `surrealdb < 2.6.1`
- `surrealdb < 3.0.0-beta.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63762)

Affected packages:

- `surrealdb < 2.6.1`
- `surrealdb >= 3.0.0-alpha.8, < 3.0.0-beta.3`

Patched in:

- `surrealdb 2.6.1`
- `surrealdb 3.0.0-beta.3`

Source: https://osv.dev/vulnerability/GHSA-xx7m-69ff-9crp