CVE-2026-63761 SurrealDB before 3.1.0 Algorithm Downgrade via ES512

What is CVE-2026-63761?

CVE-2026-63761 is a medium-severity vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORITHM ES512), because the underlying jsonwebtoken crate (v10.x) has no ES512 variant and the mapping defaults to ES384 without any error, warning, or log message. Users who supply the correct P-521 key for ES512 experience authentication handshake failures due to the curve mismatch with ES384 (which expects P-384), and tokens are rejected by external systems expecting genuine ES512 signatures. The flaw cannot be used to forge tokens or compromise data confidentiality or integrity, as ES384 remains cryptographically strong.

Weakness: CWE-327

Which versions are affected by CVE-2026-63761?

2 open source packages ship an affected version, including surrealdb. It affects 1 product.

Products include Surrealdb Surrealdb.

How do I fix CVE-2026-63761?

Upgrade surrealdb to 3.1.0 or later.

Is CVE-2026-63761 being exploited?

There is no known exploitation of CVE-2026-63761 in the wild and no public exploit code.

Other vulnerabilities in Surrealdb Surrealdb

• CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export Critical 9.4
• CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition Critical 9.2
• CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use High 8.7
• CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions High 8.7
• CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser High 8.7

All Surrealdb Surrealdb vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fwg2-gr34-q3w8.