PatchSiren cyber security CVE debrief
CVE-2026-63762 surrealdb CVE debrief
CVE-2026-63762 is a denial of service vulnerability in SurrealDB's embedded JavaScript scripting engine, enabled via the --allow-scripting capability. Users with query execution capabilities can trigger a null pointer dereference, causing the server process to terminate immediately. This vulnerability affects users who have enabled --allow-scripting or --allow-guests. The issue was addressed by updating the rquickjs dependency. An executive overview indicates that affected product deployments should be identified, and owners assigned for follow-up. Official advisories and CVE records should be reviewed to validate affected scope, severity, and vendor guidance.
- Vendor
- surrealdb
- Product
- Unknown
- CVSS
- MEDIUM 6
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-20
- Original CVE updated
- 2026-07-21
- Advisory published
- 2026-07-20
- Advisory updated
- 2026-07-21
Who should care
Users of SurrealDB, especially those who have enabled the --allow-scripting capability or --allow-guests, should be aware of this vulnerability and take steps to mitigate it. Affected operators, platforms, and security teams should review their configurations and update or restrict query execution capabilities as necessary. Vulnerability management and security teams should prioritize patching or mitigating this vulnerability to prevent potential denial of service attacks.
Technical summary
The vulnerability exists in SurrealDB's embedded JavaScript scripting engine, enabled via the --allow-scripting capability. An attacker can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown. The issue was addressed by updating the rquickjs dependency from v0.9.0 to v0.11.0. Affected product context indicates that users with query execution capabilities can exploit this vulnerability.
Defensive priority
Medium
Recommended defensive actions
- Update the rquickjs dependency to v0.11.0
- Disable the --allow-scripting capability if not necessary
- Restrict query execution capabilities to authenticated users only
- Monitor server logs for termination signals
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
Evidence notes
The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0. The vulnerability was reported by Vulncheck. SurrealDB's embedded JavaScript scripting engine is enabled via the --allow-scripting capability, which is disabled by default. Users able to execute arbitrary queries, including unauthenticated guests when --allow-guests is enabled, can trigger the vulnerability. The server process terminates immediately without graceful shutdown, requiring a manual restart. Evidence limits suggest verifying the SurrealDB version and configuration, reviewing query execution capabilities, and monitoring server logs for termination signals.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-20T12:19:46.477Z and has not been modified since then.