CVE-2025-71396 Overview
CVE-2025-71396 is a denial-of-service vulnerability in SurrealDB affecting versions before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2. The database engine does not enforce a default execution-time limit on embedded JavaScript scripting functions when scripting is explicitly enabled via --allow-scripting or --allow-all. An authenticated attacker can submit long-running JavaScript functions to exhaust server resources and cause service disruption. Scripting is disabled by default, which limits the exposure window. The issue is classified under [CWE-770] Allocation of Resources Without Limits or Throttling.
Critical Impact
Authenticated users can exhaust CPU and memory resources on SurrealDB instances with scripting enabled, resulting in denial of service against the database engine.
Affected Products
- SurrealDB versions before 2.0.5
- SurrealDB 2.1.x versions before 2.1.5
- SurrealDB 2.2.x versions before 2.2.2
Discovery Timeline
- 2026-07-18 - CVE-2025-71396 published to NVD
- 2026-07-21 - Last updated in NVD database
Technical Details for CVE-2025-71396
Vulnerability Analysis
SurrealDB supports embedded JavaScript functions when operators run the server with --allow-scripting or --allow-all. The scripting engine executes user-supplied JavaScript inside the database process context. In affected releases, the engine does not apply a default execution-time cap to these scripts. An authenticated client can submit a function containing an unbounded loop or expensive computation and hold server resources indefinitely. The engine continues executing until the process is terminated or the client disconnects.
The result is CPU saturation and potentially memory pressure on the affected node. Because SurrealDB shares the same runtime for query processing, other queries and connections degrade or stall.
Root Cause
The root cause is a missing resource throttling control [CWE-770] in the JavaScript scripting subsystem. The scripting runtime accepts function bodies from authenticated users without applying a wall-clock timeout or instruction budget. Any authenticated principal with permission to call scripting functions can therefore bypass implicit resource assumptions the operator may have about query lifetimes.
Attack Vector
Exploitation requires network access to the SurrealDB endpoint, valid authentication credentials, and a server started with scripting enabled. The attacker sends a query invoking a JavaScript function with a non-terminating body such as an infinite while (true) loop or a heavy synchronous computation. The scripting worker consumes CPU cycles until the operator intervenes.
No verified public exploit code is available for CVE-2025-71396. See the GitHub Security Advisory and the VulnCheck Advisory on SurrealDB for vendor detail.
Detection Methods for CVE-2025-71396
Indicators of Compromise
- Sustained high CPU utilization on surreal server processes without a corresponding increase in completed query volume.
- Long-running queries containing function() { ... } JavaScript bodies that fail to return within expected latency budgets.
- Authenticated sessions repeatedly submitting scripting-enabled queries followed by client disconnections.
Detection Strategies
- Audit SurrealDB startup arguments and configuration for the presence of --allow-scripting or --allow-all flags.
- Monitor query duration distributions and alert on scripting queries that exceed operator-defined thresholds.
- Correlate authenticated user identifiers with query CPU cost to identify accounts issuing disproportionately expensive scripts.
Monitoring Recommendations
- Ingest SurrealDB process metrics and query logs into a centralized logging platform for baseline and anomaly analysis.
- Track version strings reported by SurrealDB deployments and flag any instance running below 2.0.5, 2.1.5, or 2.2.2.
- Alert on repeated forced restarts of the SurrealDB service, which may indicate resource exhaustion recovery.
How to Mitigate CVE-2025-71396
Immediate Actions Required
- Upgrade SurrealDB to 2.0.5, 2.1.5, 2.2.2, or later, depending on the deployed branch.
- If upgrading is not immediately feasible, remove --allow-scripting and --allow-all from the server invocation to disable JavaScript execution.
- Review authenticated user accounts and revoke credentials for principals that do not require database access.
Patch Information
SurrealDB has released fixed builds in versions 2.0.5, 2.1.5, and 2.2.2. The fix introduces a default execution-time limit on embedded JavaScript scripting functions. Consult the GitHub Security Advisory for full remediation guidance and any configurable timeout parameters exposed by the patched releases.
Workarounds
- Run SurrealDB without the --allow-scripting and --allow-all flags to eliminate the attack surface entirely.
- Restrict network access to the SurrealDB endpoint using firewall rules or private networking so only trusted clients can authenticate.
- Enforce least-privilege authentication and rotate credentials for accounts that previously had scripting permissions.
# Configuration example: start SurrealDB without scripting enabled
surreal start --user root --pass <password> file://data.db
# Verify running version meets the patched baseline
surreal version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
