CVE-2026-63762 SurrealDB before v2.6.1 Denial of Service via scripting
Attackers can crash the SurrealDB server by triggering a null pointer dereference in the JavaScript engine, requiring manual restarts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-63762?
CVE-2026-63762 is a medium-severity vulnerability in Surrealdb Surrealdb, published on 20 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execute arbitrary queries — including unauthenticated guests when --allow-guests is enabled — can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown, requiring a manual restart. The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0.
Weakness: CWE-476
Which versions are affected by CVE-2026-63762?
4 open source packages ship an affected version, including surrealdb. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
surrealdb crates.io | All versions | 2.6.1 |
surrealdb crates.io | All versions | 2.6.1 |
surrealdb crates.io | From 3.0.0-alpha.8 | 3.0.0-beta.3 |
surrealdb crates.io | From 3.0.0-alpha.8 | 3.0.0-beta.3 |
Products include Surrealdb Surrealdb.
How do I fix CVE-2026-63762?
Upgrade surrealdb to a fixed version for your release line: 2.6.1 or 3.0.0-beta.3.
Is CVE-2026-63762 being exploited?
There is no known exploitation of CVE-2026-63762 in the wild and no public exploit code.
Other vulnerabilities in Surrealdb Surrealdb
- CVE-2025-71392 SurrealDB before 2.2.2 SurrealQL Injection via export
- CVE-2026-63756 SurrealDB before 3.1.0 Privilege Escalation via RPC Session Race Condition
- CVE-2026-63747 SurrealDB before 3.1.0 Denial of Service via malformed RPC use
- CVE-2026-63757 SurrealDB before 3.1.0 Session Hijacking via /rpc sessions
- CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser
Sources
Also known as GHSA-hxgc-2rvh-7h4r, GHSA-xx7m-69ff-9crp.