CVE-2026-63762

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 2.6.1 SurrealDB versions prior to 3.0.0-beta.3

Description A denial of service issue exists in the embedded JavaScript scripting engine, which is activated by the --allow-scripting capability. Users capable of executing arbitrary queries, including unauthenticated guests if --allow-guests is enabled, can use built-in string functions to create a large string and send it to the JavaScript runtime for compilation. This action triggers a null pointer dereference—a condition where the program attempts to read a memory address that is null—within the QuickJS-NG engine, causing the server process to terminate abruptly and requiring a manual restart.

Recommendations Update SurrealDB to version 2.6.1 or later. Update SurrealDB to version 3.0.0-beta.3 or later. Disable the --allow-scripting capability to prevent the use of the vulnerable JavaScript engine.