EUVD-2026-45933
GHSA-hxgc-2rvh-7h4r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H captures the non-default scripting capability prerequisite; PR:L reflects minimum authenticated-user requirement in base case; impact is availability-only with no C or I compromise.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execute arbitrary queries - including unauthenticated guests when --allow-guests is enabled - can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown, requiring a manual restart. The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0.
AnalysisAI
Denial of service in SurrealDB's embedded JavaScript scripting engine allows any query-executing user - including unauthenticated guests when guest access is enabled alongside scripting - to immediately crash the server process by passing an oversized string to the QuickJS-NG v0.8 runtime for compilation, triggering a null pointer dereference. The crash requires a manual operator restart with no graceful shutdown, and cannot be leveraged for code execution or data compromise. The attack is constrained to instances where the non-default --allow-scripting capability is active; no public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Technical ContextAI
SurrealDB is a multi-model database written in Rust that optionally embeds a JavaScript scripting runtime, exposed via the --allow-scripting capability flag (disabled by default). The runtime is backed by QuickJS-NG v0.8, accessed through the Rust binding crate rquickjs v0.9.0. CWE-476 (NULL Pointer Dereference) describes the root cause: when the QuickJS-NG engine attempts to compile a pathologically large string constructed through SurrealDB's built-in string functions, it dereferences a null pointer internally, causing an unrecoverable OS-level process crash that bypasses SurrealDB's own error handling. Because the crash occurs inside a C-level engine embedded via FFI, Rust's memory safety guarantees do not protect against it. Vulnerable packages are rust/surrealdb < 2.6.1 and rust/surrealdb >= 3.0.0-alpha.8, < 3.0.0-beta.3. The fix upgrades the rquickjs dependency to v0.11.0, which bundles a patched version of QuickJS-NG.
RemediationAI
Upgrade SurrealDB to v2.6.1 (stable) or v3.0.0-beta.3 (pre-release); both versions update the rquickjs dependency from v0.9.0 to v0.11.0, resolving the null pointer dereference in QuickJS-NG. Patch pull requests are available at https://github.com/surrealdb/surrealdb/pull/6774 and https://github.com/surrealdb/surrealdb/pull/6833. If immediate upgrade is not feasible, disable the scripting capability by starting SurrealDB with --deny-scripting or by setting SURREAL_CAPS_DENY_SCRIPT=true; this eliminates the attack surface entirely but disables all embedded JavaScript functions and will break any workloads relying on SurrealQL scripting. As a secondary compensating control, use --deny-arbitrary-query scoped to guest, record, or system users to prevent untrusted principals from submitting the triggering query, though this impacts application functionality for those user classes. Full vendor guidance is at https://github.com/surrealdb/surrealdb/security/advisories/GHSA-xx7m-69ff-9crp.
Privilege escalation via second-order SurrealQL injection in SurrealDB before 2.0.5, 2.1.5, and 2.2.2 lets an authentica
Privilege escalation in SurrealDB before v3.1.0 lets unauthenticated attackers hijack the privileges of concurrently-act
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the database with a single Web
Denial of service in SurrealDB before 3.1.0 lets an unauthenticated remote attacker crash the entire database process wi
Session hijacking in SurrealDB before 3.1.0 lets unauthenticated attackers enumerate attached session UUIDs through the
Cross-tenant authorization bypass in SurrealDB before 3.2.0 lets any authenticated user reach custom API endpoints belon
Arbitrary file read in SurrealDB before 3.1.5 lets an authenticated database user holding the EDITOR or OWNER role discl
Confused-deputy privilege escalation in SurrealDB before 2.5.0 and before 3.0.0-beta.3 lets a low-privileged user (e.g.
Denial of service in SurrealDB before 3.1.5 lets an authenticated user with query-execution privileges crash the entire
Denial of service in SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 lets an authenticated user with
Information disclosure in SurrealDB before 3.1.0 allows authenticated record or scope users to bypass table-level SELECT
Denial of service in SurrealDB before 2.2.2 allows any authenticated user to crash the database by submitting a crafted
Same weakness CWE-476 – NULL Pointer Dereference
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today