CVE-2026-63762: SurrealDB JavaScript Engine DoS Vulnerability

CVE-2026-63762 Overview

CVE-2026-63762 is a denial of service vulnerability affecting SurrealDB versions before v2.6.1 and before v3.0.0-beta.3. The flaw resides in the embedded JavaScript scripting engine that is activated when the --allow-scripting capability is enabled. Attackers with query execution privileges can construct large strings using built-in string functions and pass them to the JavaScript runtime for compilation. This triggers a null pointer dereference [CWE-476] in the underlying QuickJS-NG engine. The server process terminates immediately without graceful shutdown, requiring a manual restart to restore service.

Critical Impact
Any authenticated user, or unauthenticated guest when --allow-guests is enabled, can crash the SurrealDB server process by submitting a crafted query that compiles a large string in the JavaScript runtime.

Affected Products

SurrealDB versions prior to v2.6.1
SurrealDB 3.0.0 alpha1 through alpha18
SurrealDB 3.0.0 beta1 and beta2

Discovery Timeline

2026-07-20 - CVE-2026-63762 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-63762

Vulnerability Analysis

SurrealDB embeds a JavaScript scripting engine through the rquickjs Rust binding, which wraps the QuickJS-NG JavaScript runtime. When --allow-scripting is enabled, users can execute JavaScript within database queries. The vulnerability manifests when a large string is passed to the JavaScript runtime for compilation. The QuickJS-NG engine dereferences a null pointer during string compilation, causing the SurrealDB server process to crash immediately. The crash bypasses graceful shutdown logic, meaning in-flight transactions and connections are abruptly terminated. Recovery requires manual operator intervention to restart the service.

Root Cause

The root cause is a null pointer dereference within the QuickJS-NG JavaScript engine used by rquickjs v0.9.0. When compiling sufficiently large string inputs, the engine fails to validate an internal pointer before dereferencing it. SurrealDB inherits this behavior because it exposes the runtime directly to query-level JavaScript execution. The upstream fix updates the rquickjs dependency from v0.9.0 to v0.11.0.

Attack Vector

Exploitation requires network access to the SurrealDB query interface and the ability to issue queries. When --allow-guests is enabled, no authentication is needed. The attacker uses built-in SurrealQL string functions such as string::repeat to construct a large string payload. The payload is then passed to a JavaScript function block, which forwards it to the runtime for compilation. Compilation triggers the null pointer dereference, terminating the server process. Repeated exploitation after restart can sustain a denial of service condition against the database service.

See the VulnCheck Denial of Service Advisory for technical details on payload construction.

Detection Methods for CVE-2026-63762

Indicators of Compromise

Unexpected SurrealDB process termination without corresponding shutdown log entries or SIGTERM signals.
Query logs containing large string constructions such as string::repeat immediately followed by JavaScript function blocks.
Repeated client reconnection attempts against a SurrealDB endpoint following abrupt disconnects.
Operating system crash logs or systemd journal entries indicating segmentation faults in the surreal binary.

Detection Strategies

Enable SurrealDB query logging and alert on queries that combine large string generation functions with function() {} JavaScript blocks.
Monitor for process exit events on hosts running SurrealDB, correlating them with recent query activity from the same time window.
Inspect deployed SurrealDB binaries and verify the rquickjs dependency version through build metadata or dependency SBOMs.

Monitoring Recommendations

Alert when the SurrealDB service restarts outside of scheduled maintenance windows.
Track query volume and payload size distributions to identify anomalous spikes in string-heavy JavaScript queries.
Log the identities and source IP addresses of any accounts submitting scripting queries, especially guest sessions when --allow-guests is configured.

How to Mitigate CVE-2026-63762

Immediate Actions Required

Upgrade SurrealDB to v2.6.1 or v3.0.0-beta.3 or later, which ships with rquickjs v0.11.0.
Disable the --allow-scripting capability on any instance where JavaScript execution is not required.
Disable --allow-guests on production deployments to require authenticated access to the query interface.
Restrict network exposure of the SurrealDB query endpoint to trusted application tiers only.

Patch Information

SurrealDB fixed CVE-2026-63762 by updating the rquickjs dependency from v0.9.0 to v0.11.0. Patched releases are SurrealDB v2.6.1 and v3.0.0-beta.3. Refer to the GitHub Security Advisory GHSA-xx7m-69ff-9crp for the official vendor notice.

Workarounds

Start SurrealDB without the --allow-scripting flag to prevent JavaScript compilation entirely.
Enforce authentication by omitting --allow-guests and requiring named database users for all sessions.
Restrict scripting privileges to a minimal set of trusted roles through SurrealDB's permission model.
Deploy a query proxy or firewall rule set that rejects requests containing JavaScript function blocks until patching is complete.

bash

# Configuration example: start SurrealDB with scripting and guest access disabled
surreal start \
  --user root --pass "$SURREAL_ROOT_PASSWORD" \
  --bind 0.0.0.0:8000 \
  file:/var/lib/surrealdb/data
# Note: --allow-scripting and --allow-guests are intentionally omitted