CVE-2026-63762 surrealdb CVE debrief

Who should care

Users of SurrealDB, especially those who have enabled the --allow-scripting capability or --allow-guests, should be aware of this vulnerability and take steps to mitigate it. Affected operators, platforms, and security teams should review their configurations and update or restrict query execution capabilities as necessary. Vulnerability management and security teams should prioritize patching or mitigating this vulnerability to prevent potential denial of service attacks.

Technical summary

The vulnerability exists in SurrealDB's embedded JavaScript scripting engine, enabled via the --allow-scripting capability. An attacker can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown. The issue was addressed by updating the rquickjs dependency from v0.9.0 to v0.11.0. Affected product context indicates that users with query execution capabilities can exploit this vulnerability.

Defensive priority

Medium

Recommended defensive actions

• Update the rquickjs dependency to v0.11.0
• Disable the --allow-scripting capability if not necessary
• Restrict query execution capabilities to authenticated users only
• Monitor server logs for termination signals
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0. The vulnerability was reported by Vulncheck. SurrealDB's embedded JavaScript scripting engine is enabled via the --allow-scripting capability, which is disabled by default. Users able to execute arbitrary queries, including unauthenticated guests when --allow-guests is enabled, can trigger the vulnerability. The server process terminates immediately without graceful shutdown, requiring a manual restart. Evidence limits suggest verifying the SurrealDB version and configuration, reviewing query execution capabilities, and monitoring server logs for termination signals.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.