SurrealDB versions before 2.2.2 allow nested calls to native functions that embed JavaScript to issue additional queries. When a user is authenticated and scripting is enabled, the server fails to enforce its recursion limit, letting attackers chain native and JavaScript calls until the recursion becomes infinite and server memory is exhausted. This flaw is a logic error captured by CWE-674, which can interrupt service availability and degrade performance for legitimate users.

The vulnerability affects SurrealDB deployments with any version prior to 2.2.2. Only systems running those earlier releases with scripting capabilities enabled are susceptible.

With a CVSS score of 6, the flaw is considered a medium severity denial‑of‑service risk. The current EPSS score of less than 1% indicates a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated session on a server that permits JavaScript execution within native functions; an attacker can trigger the recursion and exhaust memory by repeatedly invoking nested function calls.