CVE-2026-109338: SurrealDB before 3.3.0 Denial of Service via Headers Non-ASCII Values

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-12 · updated 2026-10-13
Weakness: CWE-248

Description

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.

Affected products

surrealdb: before 3.3.0 — fixed in 3.3.0

How to fix

Upgrade to a fixed version: surrealdb 3.3.0. Check the vendor advisory for mitigations.

References

https://github.com/surrealdb/surrealdb/security/advisories/GHSA-84w9-87hm-mxqx
https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-denial-of-service-via-headers-non-ascii-values

Get alerted when CVE-2026-109338 or the next vulnerability affects your stack