Duplicate Advisory: SurrealDB no JavaScript script function default timeout could facilitate DoS

The vulnerability in SurrealDB (CVE-2025-71396) affects versions prior to 2.0.5, 2.1.0 up to but not including 2.1.5, and 2.2.0 up to but not including 2.2.2. When the scripting feature is enabled via the --allow-scripting or --allow-all flags, there is no enforced default timeout on JavaScript script execution. An authenticated attacker can exploit this by submitting long-running JavaScript functions, leading to resource exhaustion and denial of service. The scripting capability is disabled by default, which limits the attack surface unless explicitly enabled by the administrator.

An authenticated attacker can cause a denial of service by submitting long-running JavaScript functions that exhaust server resources. There is no impact on confidentiality or integrity according to the CVSS vector. The vulnerability affects availability only.

Upgrade SurrealDB to versions 2.0.5 or later, 2.1.5 or later, or 2.2.2 or later where this issue is fixed. If upgrading is not immediately possible, ensure that scripting is not enabled unless necessary, as it is disabled by default. No official patch links were provided in the advisory, but the version constraints indicate fixed versions. Patch status is confirmed by version numbers.