# surrealdb (crates.io) vulnerabilities Source: https://junglewise.ai/threats/technologies/surrealdb Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/surrealdb.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 83 vulnerabilities in surrealdb (crates.io): 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-121417, was published on 3 November 2026. 1 vulnerability in the last four weeks, up from none in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 83 (1 critical, 0 exploited in the wild) ## About surrealdb (crates.io) A multi-model database written in Rust designed for serverless, web, and mobile applications. ## Latest surrealdb (crates.io) vulnerabilities - [CVE-2026-121417: SurrealDB use-after-free in KV backends via affinitypool spawn_local](https://junglewise.ai/threats/cve-2026-121417-surrealdb-before-3-3-0-contains-a-use-after-free-vulnerability) (high, CVSS 7.8, published 3 Nov 2026) - [SurrealDB ES512 algorithm silently downgraded to ES384](https://junglewise.ai/threats/surrealdb-es512-algorithm-silently-downgraded-to-es384-f0af29b8) (medium, CVSS 4.3, published 20 Jul 2026) - [SurrealDB JSON parser denial of service via uncontrolled recursion](https://junglewise.ai/threats/surrealdb-json-parser-denial-of-service-via-uncontrolled-recursion-3037f8a0) (high, CVSS 7.5, published 20 Jul 2026) - [SurrealDB authorization bypass in KILL statement](https://junglewise.ai/threats/surrealdb-authorization-bypass-in-kill-statement-fc230d0f) (medium, CVSS 5.4, published 20 Jul 2026) - [SurrealDB permission bypass via WHERE clause evaluation](https://junglewise.ai/threats/surrealdb-permission-bypass-via-where-clause-evaluation-afa6f001) (medium, CVSS 6.5, published 20 Jul 2026) - [SurrealDB field-level permission bypass in JSON Patch](https://junglewise.ai/threats/surrealdb-field-level-permission-bypass-in-json-patch-93126efa) (medium, CVSS 4.3, published 20 Jul 2026) - [SurrealDB graph traversal bypasses table SELECT permissions](https://junglewise.ai/threats/surrealdb-graph-traversal-bypasses-table-select-permissions-e4d46f5f) (medium, CVSS 6.5, published 20 Jul 2026) - [SurrealDB port-specific deny-net rule bypass on HTTP redirect](https://junglewise.ai/threats/surrealdb-port-specific-deny-net-rule-bypass-on-http-redirect-855c5516) (medium, CVSS 6.4, published 20 Jul 2026) - [SurrealDB information disclosure via error messages](https://junglewise.ai/threats/surrealdb-information-disclosure-via-error-messages-96515867) (medium, CVSS 4.3, published 20 Jul 2026) - [SurrealDB field-level SELECT permission bypass via graph traversals](https://junglewise.ai/threats/surrealdb-field-level-select-permission-bypass-via-graph-traversals-1a29fcf0) (medium, CVSS 4.3, published 20 Jul 2026) - [SurrealDB permissions bypass via PERMISSIONS clause](https://junglewise.ai/threats/surrealdb-permissions-bypass-via-permissions-clause-3674ec45) (medium, CVSS 4.3, published 20 Jul 2026) - [SurrealDB array element-level SELECT permissions bypass](https://junglewise.ai/threats/surrealdb-array-element-level-select-permissions-bypass-b5926e1a) (medium, CVSS 6.5, published 20 Jul 2026) - [SurrealDB custom API route namespace/database scope bypass](https://junglewise.ai/threats/surrealdb-custom-api-route-namespace-database-scope-bypass-dd7e840d) (high, CVSS 8.1, published 20 Jul 2026) - [CVE-2026-63763: SurrealDB privilege escalation in futures and functions](https://junglewise.ai/threats/cve-2026-63763-surrealdb-privilege-escalation-in-futures-and-functions) (medium, CVSS 4, published 20 Jul 2026) - [CVE-2026-63762: SurrealDB denial of service in JavaScript scripting engine](https://junglewise.ai/threats/cve-2026-63762-surrealdb-denial-of-service-in-javascript-scripting-engine) (medium, CVSS 4, published 20 Jul 2026) - [CVE-2026-63761: SurrealDB cryptographic algorithm substitution in JWT access method](https://junglewise.ai/threats/cve-2026-63761-surrealdb-cryptographic-algorithm-substitution-in-jwt-access) (medium, CVSS 4.3, published 20 Jul 2026) - [CVE-2026-63760: SurrealDB uncontrolled recursion in JSON parser](https://junglewise.ai/threats/cve-2026-63760-surrealdb-uncontrolled-recursion-in-json-parser) (high, CVSS 7.5, published 20 Jul 2026) - [CVE-2026-63758: SurrealDB authorization bypass in KILL statement](https://junglewise.ai/threats/cve-2026-63758-surrealdb-authorization-bypass-in-kill-statement) (medium, CVSS 5.4, published 20 Jul 2026) - [CVE-2026-63755: SurrealDB authorization bypass in WHERE clause evaluation](https://junglewise.ai/threats/cve-2026-63755-surrealdb-authorization-bypass-in-where-clause-evaluation) (medium, CVSS 6.5, published 20 Jul 2026) - [CVE-2026-63751: SurrealDB field-level permission bypass in JSON Patch operations](https://junglewise.ai/threats/cve-2026-63751-surrealdb-field-level-permission-bypass-in-json-patch-operations) (medium, CVSS 4.3, published 20 Jul 2026) - [CVE-2026-63748: SurrealDB information disclosure via error messages in UPDATE operations](https://junglewise.ai/threats/cve-2026-63748-surrealdb-information-disclosure-via-error-messages-in-update) (medium, CVSS 4.3, published 20 Jul 2026) - [CVE-2026-63746: SurrealDB authorization bypass via graph traversal](https://junglewise.ai/threats/cve-2026-63746-surrealdb-authorization-bypass-via-graph-traversal) (medium, CVSS 6.5, published 20 Jul 2026) - [CVE-2026-63743: SurrealDB capability bypass in HTTP redirect handling](https://junglewise.ai/threats/cve-2026-63743-surrealdb-capability-bypass-in-http-redirect-handling) (medium, CVSS 6.4, published 20 Jul 2026) - [CVE-2026-63740: SurrealDB incorrect authorization in array element SELECT permissions](https://junglewise.ai/threats/cve-2026-63740-surrealdb-incorrect-authorization-in-array-element-select) (medium, CVSS 6.5, published 20 Jul 2026) - [CVE-2026-63738: SurrealDB field-level SELECT permission bypass in graph traversals](https://junglewise.ai/threats/cve-2026-63738-surrealdb-field-level-select-permission-bypass-in-graph) (medium, CVSS 4.3, published 20 Jul 2026) ## Most severe surrealdb (crates.io) vulnerabilities - [CVE-2025-71392: SurrealDB SurrealQL injection in command-line export](https://junglewise.ai/threats/cve-2025-71392-surrealdb-surrealql-injection-in-command-line-export) (critical, CVSS 4, published 18 Jul 2026) - [CVE-2024-58362: SurrealDB query injection in RPC API signin and signup operations](https://junglewise.ai/threats/cve-2024-58362-surrealdb-query-injection-in-rpc-api-signin-and-signup-operations) (high, CVSS 8.8, published 18 Jul 2026) - [CVE-2023-54366: SurrealDB insecure default table permissions](https://junglewise.ai/threats/cve-2023-54366-surrealdb-insecure-default-table-permissions) (high, CVSS 8.8, published 18 Jul 2026) - [SurrealDB deny-net bypass via DNS resolution](https://junglewise.ai/threats/surrealdb-deny-net-bypass-via-dns-resolution-54b52c8a) (high, CVSS 8.8, published 18 Jul 2026) - [SurrealDB insecure default table permissions](https://junglewise.ai/threats/surrealdb-insecure-default-table-permissions-36fa4a9b) (high, CVSS 8.8, published 18 Jul 2026) - [SurrealDB session hijacking via HTTP RPC session leak](https://junglewise.ai/threats/surrealdb-session-hijacking-via-http-rpc-session-leak-016308ef) (high, CVSS 8.8, published 1 Jul 2026) - [CVE-2024-58366: SurrealDB format string vulnerability in rquickjs scripting engine](https://junglewise.ai/threats/cve-2024-58366-surrealdb-format-string-vulnerability-in-rquickjs-scripting) (high, CVSS 8.5, published 18 Jul 2026) - [CVE-2026-63735: SurrealDB authorization bypass in custom API routes](https://junglewise.ai/threats/cve-2026-63735-surrealdb-authorization-bypass-in-custom-api-routes) (high, CVSS 8.1, published 20 Jul 2026) - [SurrealDB custom API route namespace/database scope bypass](https://junglewise.ai/threats/surrealdb-custom-api-route-namespace-database-scope-bypass-dd7e840d) (high, CVSS 8.1, published 20 Jul 2026) - [SurrealDB privilege escalation via HTTP RPC session race condition](https://junglewise.ai/threats/surrealdb-privilege-escalation-via-http-rpc-session-race-condition-871af91c) (high, CVSS 8.1, published 1 Jul 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 1 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other crates.io technologies - [wasmtime (crates.io)](https://junglewise.ai/threats/technologies/wasmtime): 67 vulnerabilities - [deno (crates.io)](https://junglewise.ai/threats/technologies/deno): 39 vulnerabilities - [zebrad (crates.io)](https://junglewise.ai/threats/technologies/zebrad): 27 vulnerabilities - [russh (crates.io)](https://junglewise.ai/threats/technologies/crates-io-russh): 26 vulnerabilities - [openssl-src (crates.io)](https://junglewise.ai/threats/technologies/openssl-src): 26 vulnerabilities - [openssl (crates.io)](https://junglewise.ai/threats/technologies/crates-io-openssl): 25 vulnerabilities - [rustfs (crates.io)](https://junglewise.ai/threats/technologies/rustfs): 25 vulnerabilities - [coreutils (crates.io)](https://junglewise.ai/threats/technologies/crates-io-coreutils): 21 vulnerabilities - [ckb (crates.io)](https://junglewise.ai/threats/technologies/ckb): 19 vulnerabilities - [apollo-router (crates.io)](https://junglewise.ai/threats/technologies/apollo-router): 13 vulnerabilities - [deepseek-tui (crates.io)](https://junglewise.ai/threats/technologies/deepseek-tui): 13 vulnerabilities - [diesel (crates.io)](https://junglewise.ai/threats/technologies/diesel): 13 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "surrealdb (crates.io) vulnerabilities", https://junglewise.ai/threats/technologies/surrealdb, 11 November 2026.