SurrealDB fails to enforce a default execution time limit on embedded JavaScript scripting functions when scripting is explicitly enabled (via --allow-scripting or --allow-all). An authenticated user can submit long-running JavaScript functions that consume server resources, leading to a denial of service. The weakness belongs to the abnormal resource consumption family (CWE-770).

SurrealDB is affected on all releases prior to 2.0.5, prior to 2.1.5 in the 2.1.x branch, and prior to 2.2.2 in the 2.2.x branch. Any instance that has scripting enabled is potentially vulnerable.

The CVSS score of 2.3 indicates a low severity rating, and the EPSS score of less than 1% suggests a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an authenticated identity that has permission to enable scripting. With scripting enabled, an attacker could craft a lengthy JavaScript function to exhaust memory or CPU resources, temporarily disabling the server or affecting availability for legitimate users. Because scripting is disabled by default, the risk is mitigated until an administrator explicitly enables it. However, in environments where scripting is enabled, the denial-of-service impact can be significant for the affected instance.