CVE-2026-63762 in SurrealDB
Summary
by MITRE • 07/20/2026
SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execute arbitrary queries — including unauthenticated guests when --allow-guests is enabled — can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown, requiring a manual restart. The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/20/2026
The vulnerability exists within SurrealDB's embedded JavaScript scripting engine, specifically affecting versions prior to v2.6.1 and v3.0.0-beta.3. This denial of service flaw is activated through the --allow-scripting capability which remains disabled by default but becomes exploitable when enabled. The security risk manifests when users can execute arbitrary queries, including unauthenticated guests when the --allow-guests flag is enabled, creating a significant attack surface for malicious actors seeking to disrupt service availability.
The technical implementation of this vulnerability involves the exploitation of built-in string functions within SurrealDB's query execution environment. Attackers can construct large strings and pass them to the JavaScript runtime for compilation, which triggers a null pointer dereference within the underlying QuickJS-NG engine. This specific memory access violation causes the server process to terminate abruptly without performing any graceful shutdown procedures, resulting in immediate service disruption that requires manual intervention to restore normal operations.
The operational impact of this vulnerability extends beyond simple service interruption as it affects system reliability and availability in production environments where SurrealDB is deployed with scripting capabilities enabled. The abrupt termination without graceful shutdown can potentially lead to data inconsistencies or loss of ongoing transactions, particularly in scenarios where the database serves critical business functions. Network administrators and security teams must account for this vulnerability when assessing risk exposure, especially in environments where guest access is permitted.
This vulnerability maps to CWE-476 which specifically addresses null pointer dereference conditions in software implementations. From an adversarial perspective, this issue aligns with ATT&CK technique T1499.004 which focuses on network denial of service attacks through resource exhaustion or process termination. The exploitability characteristics indicate that any authenticated user with query execution privileges can trigger the vulnerability, making it particularly dangerous in multi-tenant environments or systems where guest access is enabled.
The remediation strategy involves updating the rquickjs dependency from version v0.9.0 to v0.11.0, which contains the necessary fixes for the QuickJS-NG engine's null pointer dereference issue. Organizations should prioritize this update as part of their security maintenance routine, particularly for systems where scripting capabilities are enabled. System administrators should also consider implementing monitoring for unexpected process terminations and establish automated alerting mechanisms to quickly detect similar service disruptions that may indicate exploitation attempts.
Mitigation strategies beyond the immediate patch include reviewing and restricting the --allow-scripting flag configuration, implementing proper access controls to limit query execution privileges, and conducting regular security assessments of database environments. The vulnerability demonstrates the importance of dependency management in database systems and highlights how seemingly isolated engine components can lead to critical service availability issues when not properly maintained or updated with security patches from upstream dependencies.