What normal form does a surrogate key violate?

Arguably, it doesn't.

Adding a surrogate key is an implementation decision (to respect how the RDBMS works) taken at implementation time. During modelling and normalisation, you should end up with BCNF (slightly stricter and more correct 3NF) without surrogate keys

That is, introducing surrogate keys at the start of the design process is wrong. Even though we all do it...

Arguably a surrogate key is not the natural key of the table, so it could be said to violate the 'nothing but the key' principle of 3NF. In practice a surrogate key is just a place holder for the natural key, so this argument is academic at best.

Some obscure normal forms require composite keys to become relevant. 5NF comes to mind in this case as it requires multiple overlapping composite keys on a M:M relationship for a 5NF violation to be possible.

It doesn't. Keys of any kind don't in themselves violate any normal form. It is the set of dependencies you expect the table to represent that defines whether any NF is being satisfied or not.

It's true that adding a surrogate key does imply an extra set of dependencies on that key. By definition those extra dependencies are join dependencies implied by superkeys, which means 5NF and DKNF for example are not violated. The only possible exception is if some proper subset of the attributes (partial key) of the surrogate is a determinant in its own right. Given that "surrogate" normally means a single attribute key whose values are arbitrary such a partial key dependency is unlikely.

6NF could be violated by the addition of the surrogate key attribute but if so then that's due simply to adding an attribute - it's not a problem specifically with surrogate keys.