{"items":[{"id":"NVI-00014035","kind":"vulnerability","title":"SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fwg2-gr34-q3w8","CVE-2026-63761"],"plain_summary":"GitHub lists this reviewed advisory for surrealdb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-19f4a78b89f6c749136a32df15d816e7"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-04T20:28:53.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-35c44da8440573d3baaf7b252742f570"},{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.278%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.20325. Missing scores are unknown.","source_id":"sr-19f4a78b89f6c749136a32df15d816e7"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-35c44da8440573d3baaf7b252742f570","url":"https://github.com/advisories/GHSA-fwg2-gr34-q3w8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fwg2-gr34-q3w8","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:52.377Z"},{"id":"sr-19f4a78b89f6c749136a32df15d816e7","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-63761","publisher":"FIRST EPSS","observed_at":"2026-11-04T23:33:33.058Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-35c44da8440573d3baaf7b252742f570"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"When a user configures `ALGORITHM ES512` for any JWT access method (`DEFINE ACCESS ... TYPE JWT ALGORITHM ES512`), SurrealDB silently substitutes ES384 at all four internal algorithm conversion points. This occurs because the underlying `jsonwebtoken` crate (v10.x) does not include an ES512 algorithm variant, so the mapping defaults to ES384 without raising an error, warning, or log message.\n \nUsers who provide the correct P-521 key type for ES512 will experience authentication handshake failures due to the curve mismatch with ES384 (which expects P-384).\n \n### Impact\n \nAuthentication handshake failures when using ES512 with the correct P-521 key type, and when tokens are verified by external systems expecting real ES512 signatures. \n \nThis vulnerability cannot be exploited to forge tokens or compromise the integrity or confidentiality of data handled by SurrealDB, as ES384 remains cryptographically strong.\n\n### Patches\n \nVersions prior to SurrealDB `v3.1.0` are vulnerable.\n \nThe patches for SurrealDB `v3.1.0` block new `DEFINE ACCESS` statements using `ALGORITHM ES512` with a clear error message and add deprecation warnings at runtime for existing stored ES512 definitions.\n\n### Wo","public_affected_ranges":["< 3.1.0"]}],"null_published_at":"2026-11-08T19:53:38.949Z","source_updated_at":"2026-09-04T20:28:53.000Z","source_disclosed_at":"2026-07-01T20:23:01.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-02T02:20:52.377Z"},{"id":"NVI-00014035","kind":"vulnerability","title":"SurrealDB: ES512 silently downgraded to ES384 due to jsonwebtoken crate limitation","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-fwg2-gr34-q3w8","CVE-2026-63761"],"plain_summary":"GitHub lists this reviewed advisory for surrealdb. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-35c44da8440573d3baaf7b252742f570"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-04T20:28:53.000Z","value":"4.3 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-35c44da8440573d3baaf7b252742f570"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-35c44da8440573d3baaf7b252742f570","url":"https://github.com/advisories/GHSA-fwg2-gr34-q3w8","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-fwg2-gr34-q3w8","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:52.377Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-35c44da8440573d3baaf7b252742f570"],"technology":"surrealdb","known_exclusions":[],"conditions_summary":"When a user configures `ALGORITHM ES512` for any JWT access method (`DEFINE ACCESS ... TYPE JWT ALGORITHM ES512`), SurrealDB silently substitutes ES384 at all four internal algorithm conversion points. This occurs because the underlying `jsonwebtoken` crate (v10.x) does not include an ES512 algorithm variant, so the mapping defaults to ES384 without raising an error, warning, or log message.\n \nUsers who provide the correct P-521 key type for ES512 will experience authentication handshake failures due to the curve mismatch with ES384 (which expects P-384).\n \n### Impact\n \nAuthentication handshake failures when using ES512 with the correct P-521 key type, and when tokens are verified by external systems expecting real ES512 signatures. \n \nThis vulnerability cannot be exploited to forge tokens or compromise the integrity or confidentiality of data handled by SurrealDB, as ES384 remains cryptographically strong.\n\n### Patches\n \nVersions prior to SurrealDB `v3.1.0` are vulnerable.\n \nThe patches for SurrealDB `v3.1.0` block new `DEFINE ACCESS` statements using `ALGORITHM ES512` with a clear error message and add deprecation warnings at runtime for existing stored ES512 definitions.\n\n### Wo","public_affected_ranges":["< 3.1.0"]}],"null_published_at":"2026-11-02T10:00:37.199Z","source_updated_at":"2026-09-04T20:28:53.000Z","source_disclosed_at":"2026-07-01T20:23:01.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:20:52.377Z"}],"next_cursor":null,"snapshot_revision":"42594"}