CVE-2026-63762
Received Received - Intake

SurrealDB QuickJS Engine Null Pointer Dereference DoS

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execute arbitrary queries — including unauthenticated guests when --allow-guests is enabled — can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown, requiring a manual restart. The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63762
EUVD
EUVD-2026-45933

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
surrealdb surrealdb to 2.6.1|end_excluding=3.0.0-beta.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-476 The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63762 is a denial of service vulnerability in SurrealDB versions before 2.6.1 and 3.0.0-beta.3. It affects the embedded JavaScript scripting engine when the --allow-scripting capability is enabled. Attackers with query execution privileges can crash the server by passing a large string to the JavaScript runtime, triggering a null pointer dereference in the QuickJS-NG engine. This causes the server to terminate immediately without graceful shutdown.

Detection Guidance

Check if SurrealDB is running with --allow-scripting enabled by inspecting process arguments or configuration files. Monitor server logs for unexpected crashes or null pointer dereference errors in the JavaScript engine. Use network scanning tools to detect SurrealDB instances and verify their versions are below 2.6.1 or 3.0.0-beta.3.

Impact Analysis

This vulnerability allows attackers to crash the SurrealDB server, causing downtime and requiring manual restart. If guest access is enabled, unauthenticated users can exploit it. The server becomes unavailable until restarted, disrupting database operations and potentially leading to data access issues.

Compliance Impact

This vulnerability primarily causes service disruption by crashing the SurrealDB server, which could lead to prolonged downtime if not addressed promptly. For compliance with standards like GDPR or HIPAA, such disruptions may violate availability requirements, especially if the system is part of critical infrastructure handling sensitive data. However, the vulnerability does not directly expose or compromise data, so confidentiality and integrity are not directly impacted.

Mitigation Strategies

Disable scripting by setting --deny-scripting in SurrealDB configuration or command line. If scripting is required, upgrade to SurrealDB v2.6.1 or later (or v3.0.0-beta.3). Disable guest access if enabled via --allow-guests. Restrict query execution permissions to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart