Is CVE-2026-63762 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63762 being exploited in the wild.

How severe is CVE-2026-63762?

Medium severity, with a CVSS score of 4, published 20 July 2026.

Which products and versions are affected?

surrealdb (crates.io) SEMVER:introduced=0,fixed=2.6.1.

Is there a fix for CVE-2026-63762?

Yes. surrealdb (crates.io): upgrade to 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-63762 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-63762?

Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63762: SurrealDB denial of service in JavaScript scripting engine

CVE-2026-63762 · Severity: medium · CVSS 4 · Published 2026-07-20

SurrealDB is a multi-model database used for managing and querying application data. A vulnerability in its optional JavaScript scripting engine allows an attacker to crash the database server by sending a specially crafted query. This results in an immediate service outage that requires a manual restart to restore operations.

Technologies: surrealdb (crates.io). Vendors: crates.io.

Quick answers

Is CVE-2026-63762 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63762 being exploited in the wild.
How severe is CVE-2026-63762?: Medium severity, with a CVSS score of 4, published 20 July 2026.
Which products and versions are affected?: surrealdb (crates.io) SEMVER:introduced=0,fixed=2.6.1.
Is there a fix for CVE-2026-63762?: Yes. surrealdb (crates.io): upgrade to 2.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63762 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-63762?: Check whether you run surrealdb (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

surrealdb (crates.io): upgrade to 2.6.1 or later
```
cargo update -p surrealdb
```

Technical details

A NULL pointer dereference exists in the QuickJS-NG engine used by SurrealDB's embedded JavaScript runtime. The vulnerability is reachable when the --allow-scripting flag is enabled. An attacker with query execution privileges (which may include unauthenticated guests if --allow-guests is active) can use built-in string functions to construct an oversized string. When this string is passed to the JavaScript runtime for compilation, it triggers a crash in the underlying rquickjs dependency (v0.9.0). The issue was resolved by updating rquickjs to v0.11.0. Administrators can mitigate the risk by using the --deny-scripting flag.

Affected products

SurrealDB SurrealDB < v2.6.1, < v3.0.0-beta.3

Identifiers

CVE-2026-63762
GHSA-xx7m-69ff-9crp

Timeline

2026-02-12: advisory: GitHub Security Advisory published
2026-07-20: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.