Denial of Service via nested type annotations in SurrealDB (CVE-2026-63759)

SurrealDB's type/kind parser failed to enforce the configured recursion depth limit when processing nested type annotations, unlike the expression parser which already applied this limit. An authenticated attacker can exploit this by sending a query containing deeply nested type annotations (e.g., array<option<array<option<...>>>>) over a single WebSocket message, exhausting server memory and crashing the process. Affected versions: - <3.1.0 We recommend updating to: 3.1.0. CVSS 7.1 · our assessment: this_week Reference: https://github.com/surrealdb/surrealdb/security/advisories/GHSA-q8qp-67f9-wr3f Details: https://vuln.today/cve/CVE-2026-63759