surrealdb
crates.io54 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting surrealdbpage 2 of 2
- CVE-2026-63760HIGHCVSS 7.5EG 7.5fixed in 3.1.02026-07-20
SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSoc…
- CVE-2026-63761MEDIUMCVSS 4.3EG 4.3fixed in 3.1.02026-07-20
SurrealDB before 3.1.0 silently substitutes the ES384 algorithm when a JWT access method is configured with ALGORITHM ES512 (DEFINE ACCESS ... TYPE JWT ALGORITHM ES512), because the underlying jsonwebtoken crate (v10.x) has no ES512 varian…
- CVE-2026-63762MEDIUMCVSS 6.5EG 6.5fixed in 2.6.1 or 3.0.0-beta.3, by version range2026-07-20
SurrealDB before v2.6.1 (and before v3.0.0-beta.3) contains a denial of service vulnerability in its embedded JavaScript scripting engine, which is enabled via the --allow-scripting capability (disabled by default). Any user able to execut…
- CVE-2026-63763HIGHCVSS 8.8EG 8.8fixed in 2.5.0 or 3.0.0-beta.3, by version range2026-07-20
SurrealDB before 2.5.0 and before 3.0.0-beta.3 contains a confused deputy privilege escalation vulnerability. Unprivileged users (e.g., those with the database editor role) can create or modify fields containing futures, functions, or clos…
Check whether surrealdb is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for surrealdb CVEs against the assets you own.
Book a Demo →