SurrealDB has Denial of Service in JSON parser due to nested objects (CVE-2026-63760)

The SurrealDB value and JSON parser did not enforce the configured recursion depth limit when parsing nested '{', '[', or '(' tokens, unlike the expression parser which did enforce this limit. This omission allows an unauthenticated remote attacker to send a deeply nested JSON payload to the WebSocket /rpc endpoint, exhausting server memory and crashing the SurrealDB process. This vulnerability is a partial regression of a previous fix (GHSA-6r8p-hpg7-825g) that addressed the same issue in the expression parser but not the value/JSON parser. The patch enforces the recursion depth limit in parse_value and parse_json functions, aligning them with the rest of the parser code. Versions 3.1.0 and later are not affected.

An unauthenticated remote attacker can cause a denial of service by crashing the SurrealDB server with a single specially crafted WebSocket message containing deeply nested JSON. This does not require any credentials or query execution privileges, making the attack surface broad and easy to exploit for service disruption.

A patch is available that enforces the recursion depth limit in the JSON and value parsers. Upgrading to SurrealDB version 3.1.0 or later fully mitigates this vulnerability. As a workaround, restrict network access to the WebSocket /rpc endpoint to trusted clients to reduce exposure until the patch can be applied.