SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation (CVE-2026-63761)

SurrealDB versions before 3.1.0 have a vulnerability (CVE-2026-63761) where configuring JWT access methods with ALGORITHM ES512 results in silent substitution to ES384 at internal conversion points. This occurs because the jsonwebtoken crate (v10.x) lacks ES512 support, defaulting to ES384 without error or warning. Users providing the correct P-521 key for ES512 experience authentication handshake failures due to curve mismatches with ES384 (which expects P-384). The vulnerability does not enable token forgery or compromise confidentiality or integrity, as ES384 remains cryptographically strong. SurrealDB 3.1.0 patches this by blocking new ES512 definitions with error messages and adding runtime deprecation warnings for existing ES512 configurations. Users are advised to reconfigure JWT access methods to supported algorithms like ES384.

The vulnerability causes authentication handshake failures when using ES512 with the correct P-521 key type, and when tokens are verified by external systems expecting genuine ES512 signatures. There is no impact on token integrity, confidentiality, or the ability to forge tokens. The issue results in denial of authentication functionality rather than security compromise.

A patch is available in SurrealDB version 3.1.0 that blocks the use of ES512 with clear error messages and adds deprecation warnings for existing ES512 configurations. Users should upgrade to version 3.1.0 or later. Additionally, users should review and update any DEFINE ACCESS statements specifying ALGORITHM ES512 to use supported algorithms such as ES384 with the appropriate P-384 key pair.