GHSA-XX7M-69FF-9CRP: SurrealDB's Poison Pill: Crashing the Database with a Single String

SurrealDB's Poison Pill: Crashing the Database with a Single String Vulnerability ID: GHSA-XX7M-69FF-9CRP CVSS Score: 6.5 Published: 2026-02-12 A critical Denial of Service vulnerability exists in SurrealDB's embedded JavaScript engine, QuickJS. By defining a scripting function containing an excessively large string literal, an attacker can trigger a Null Pointer Dereference (CWE-476) within the compilation phase. This memory safety violation bypasses Rust's safety guarantees, causing the entire database process to terminate immediately via a segmentation fault. TL;DR SurrealDB embeds the QuickJS engine to allow inline JavaScript functions. A flaw in how QuickJS handles massive string literals during compilation allows an attacker to trigger a Null Pointer Dereference. By submitting a crafted SurrealQL query that generates a huge string and feeds it to the JS engine, an authenticated user can crash the server instantly. The fix involves updating the internal rquickjs dependency. ⚠️ Exp