SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-71396 · Microsoft / collected KEV context

EUVD-2025-210487

GHSA-6g9r-xqrf-34xh

GHSA-3824-qmfq-2qv7

cve-program · CVE-2025-71396

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7
• https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting

euvd · EUVD-2025-210487

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7
• https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting

nvd · CVE-2025-71396

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7
• https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting

osv · GHSA-3824-qmfq-2qv7

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7
• https://github.com/surrealdb/surrealdb/pull/5597
• https://github.com/surrealdb/surrealdb

osv · GHSA-6g9r-xqrf-34xh

• https://github.com/surrealdb/surrealdb/security/advisories/GHSA-3824-qmfq-2qv7
• https://nvd.nist.gov/vuln/detail/CVE-2025-71396
• https://www.vulncheck.com/advisories/surrealdb-before-denial-of-service-via-javascript-scripting

• SurrealDB before 2.2.2 Denial of Service via JavaScript Scripting · Affected-version evidence changed · 29 Oct 2026