CVE-2026-63762

SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execute arbitrary queries — including unauthenticated guests when --allow-guests is enabled — can use built-in string functions to construct a large string and pass it to the JavaScript runtime for compilation, triggering a null pointer dereference in the underlying QuickJS-NG engine. This causes the server process to terminate immediately without graceful shutdown, requiring a manual restart. The issue was fixed by updating the rquickjs dependency from v0.9.0 to v0.11.0.

• CWE-476

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-xx7m-69ff-9crpMitigation, Vendor Advisory
• https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-scriptingThird Party Advisory

Published

Jul 20, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63757SurrealDB versions before 3.1.0 contain a session hijacking …8.8
• CVE-2026-63758SurrealDB versions before 3.1.0 contain an authorization byp…5.4
• CVE-2026-63759SurrealDB before 3.1.0 fails to enforce recursion depth limi…7.1
• CVE-2026-6376A weakness in SpiceJet’s public booking retrieval page permi…8.7
• CVE-2026-63760SurrealDB before 3.1.0 fails to enforce the configured recur…8.7
• CVE-2026-63761SurrealDB before 3.1.0 silently substitutes the ES384 algori…5.3
• CVE-2026-63763SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a co…8.8
• CVE-2026-63764LMDeploy through 0.14.0, fixed in commit 03c3130, contains a…8.6
• CVE-2026-63765Chatwoot before 4.16.0 contains an authentication bypass vul…8.8
• CVE-2026-63766GPT-SoVITS through 20250606v2pro contains an OS command inje…9.8
• CVE-2026-63767ktransformers through 0.6.3, fixed in commit def0f93, contai…9.8
• CVE-2026-63768cal.diy through 6.2.0 contains an open redirect vulnerabilit…5.3