SurrealDB versions prior to 2.6.1 (and before 3.0.0‑beta.3) contain a denial‑of‑service flaw in the embedded JavaScript engine. The flaw is triggered when a user executes an arbitrary query that constructs a very large string and passes it to the QuickJS‑NG runtime for compilation. The runtime dereferences a null pointer, causing the SurrealDB server to crash immediately without a graceful shutdown; a manual restart is then required. The vulnerability is classified as a null pointer dereference (CWE‑476).

The affected product is SurrealDB. Versions earlier than 2.6.1 (and earlier than 3.0.0‑beta.3) are at risk. The issue is only active when the server is run with the --allow‑scripting capability enabled, which is disabled by default. Users who can execute arbitrary queries—including unauthenticated guests when --allow‑guests is enabled—can exploit the flaw.

The threat is moderate. The exploitation requires query‑execution access, which is possible for any user who can run arbitrary queries on the database. The denial of service can disrupt availability and may necessitate manual intervention to restore service. The EPSS score is less than 1%, indicating a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The presence of the vulnerability in production environments that allow scripting or guest access increases the attack surface, but the overall likelihood of exploitation remains low.