CVE-2026-109338

6.5Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.5Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on availability
Weakness: CWE-248

Impact

Authenticated users with query permissions can crash the SurrealDB server process by triggering an unhandled exception via embedded JavaScript. Exploitation requires network access and an account permitted to execute scripts and queries.

Root cause

The embedded JavaScript engine lacks proper error handling for non-ASCII HTTP header values, causing the server process to abort when reading them via Headers methods or fetch() responses.

Affected systems

SurrealDB before 3.3.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade SurrealDB to version 3.3.0 or later. If upgrading cannot happen immediately, restrict query access or disable embedded JavaScript execution for untrusted users.

shell

$ surreal version

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109338