---
id: CVE-2026-109338
title: >-
  SurrealDB before 3.3.0 contains a denial of service vulnerability that allows
  query-capable users to crash the server by reading non-ASCII header values in
  embedded JavaScript
summary: >-
  SurrealDB before 3.3.0 contains a denial of service vulnerability that allows
  query-capable users to crash the server by reading non-ASCII header values in
  embedded JavaScript. Attackers with scripting enabled can read such values via
  He…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-248
published: '2026-10-12'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T17:17:30.183'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-109338'
references:
  - url: >-
      https://github.com/surrealdb/surrealdb/security/advisories/GHSA-84w9-87hm-mxqx
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/surrealdb-before-3.3.0-denial-of-service-via-headers-non-ascii-values
    label: disclosure@vulncheck.com
tags:
  - nvd
ingestedAt: '2026-10-12T18:00:08.207Z'
---

## Overview

SurrealDB before 3.3.0 contains a denial of service vulnerability that allows query-capable users to crash the server by reading non-ASCII header values in embedded JavaScript. Attackers with scripting enabled can read such values via Headers get(), entries(), values(), or getSetCookie(), or return them from fetch() endpoints, aborting the server process.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.