CVE-2025-71393 Overview
CVE-2025-71393 affects SurrealDB versions before 2.2.2 when scripting is enabled. The database fails to enforce recursion limits when native functions contain embedded JavaScript that issues new queries. Authenticated attackers can chain native and JavaScript function calls to trigger infinite recursion. The recursion exhausts server memory and crashes the database process. This flaw is tracked under CWE-674: Uncontrolled Recursion. The issue is documented in the GitHub Security Advisory GHSA-m7rc-8w7m-r9qr and the VulnCheck Security Advisory.
Critical Impact
Authenticated attackers can crash SurrealDB instances by exhausting server memory through nested native and JavaScript function calls.
Affected Products
- SurrealDB versions prior to 2.2.2
- SurrealDB deployments with scripting enabled
- Any instance permitting authenticated users to invoke embedded JavaScript functions
Discovery Timeline
- 2026-07-18 - CVE-2025-71393 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2025-71393
Vulnerability Analysis
SurrealDB supports embedded JavaScript execution within native database functions when scripting is enabled. The engine enforces a recursion limit to protect against runaway function calls. However, the enforcement logic does not track recursion across the boundary between native SurrealQL functions and embedded JavaScript that issues new queries.
An authenticated attacker can define a native function that invokes JavaScript. That JavaScript then issues a query that calls the same native function. Each hop resets the recursion counter. The chain continues until the process consumes all available memory. The database instance terminates and denies service to legitimate users.
The issue is classified as CWE-674: Uncontrolled Recursion. Exploitation requires authentication and scripting privileges but no user interaction. The attack targets availability without affecting confidentiality or integrity.
Root Cause
The recursion limit tracker operates within a single execution context. When a native function transitions into embedded JavaScript, and that JavaScript issues a new query through the query interface, the runtime treats the new query as a fresh execution context. The counter starts over. This gap in enforcement allows unbounded call chains.
Attack Vector
The attack requires network access to the SurrealDB query interface and valid credentials with permission to define or execute scripted functions. The attacker submits a query that defines mutually recursive native and JavaScript functions. Executing the entry function initiates the recursion loop. Memory consumption grows until the operating system kills the process or the host runs out of resources.
No verified public exploit code is available. Refer to the VulnCheck Security Advisory for additional technical context.
Detection Methods for CVE-2025-71393
Indicators of Compromise
- Rapid growth in SurrealDB process memory (RSS) followed by out-of-memory termination
- Repeated query submissions from a single authenticated session that define nested functions calling embedded JavaScript
- Database logs showing repeated invocations of the same user-defined function with escalating call depth
- Unexpected surreal process restarts or crash entries in the system journal
Detection Strategies
- Monitor SurrealDB query logs for DEFINE FUNCTION statements that combine native SurrealQL with function() JavaScript blocks issuing new queries
- Alert on authenticated sessions that create then invoke mutually recursive functions within a short window
- Correlate database process memory spikes with recent query activity from specific users or API tokens
- Baseline normal function execution depth and flag deviations
Monitoring Recommendations
- Enable verbose query logging on SurrealDB instances where scripting is permitted
- Ship database logs and host resource metrics to a centralized analytics platform for correlation
- Track per-user query rate and function definition activity to identify anomalous behavior
- Configure alerts for SurrealDB process exits with signal SIGKILL or exit code indicating OOM
How to Mitigate CVE-2025-71393
Immediate Actions Required
- Upgrade SurrealDB to version 2.2.2 or later on all affected deployments
- Audit which authenticated principals hold permission to define or execute scripted functions
- Revoke scripting privileges from accounts that do not require them
- Review recent query logs for suspicious function definitions matching the recursion pattern
Patch Information
SurrealDB 2.2.2 corrects the recursion tracking so that limits apply across native-to-JavaScript-to-query boundaries. Deploy the fixed release from the official SurrealDB distribution channels. Full details are available in the GitHub Security Advisory GHSA-m7rc-8w7m-r9qr.
Workarounds
- Disable scripting entirely on SurrealDB instances that do not require embedded JavaScript execution
- Restrict function definition and execution permissions to trusted administrative accounts only
- Apply per-user memory or CPU cgroup limits to the SurrealDB process to contain resource exhaustion
- Place SurrealDB behind a query-aware proxy that rejects submissions containing nested function() blocks from untrusted sessions
# Disable scripting when starting SurrealDB (workaround pending patch)
surreal start --no-scripting --auth --user root --pass <password> file:/var/lib/surrealdb
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
