CVE-2026-52746: JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion
Impact In JSONata <v2.2.0, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.
Patches This issue has been addressed in JSONata version >= 2.2.0 via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.
References https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0
Credit Thank you to Doruk Tan Öztürk for disclosing this issue.
Other sources
JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/jsonatato a version that resolves this vulnerability.Fixed in 2.2.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.2.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.9
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52746?
The severity of CVE-2026-52746 is high, with a score of 7.5.
What is the impact of CVE-2026-52746?
CVE-2026-52746 can cause a denial of service due to superlinear backtracking in the ISO-8601 validation regex.
How do I fix CVE-2026-52746?
To fix CVE-2026-52746, you should upgrade to JSONata version 2.2.0 or later.
Which software is affected by CVE-2026-52746?
CVE-2026-52746 affects the npm/jsonata software library.
What causes the vulnerability in CVE-2026-52746?
CVE-2026-52746 is caused by non-matching inputs to the $toMillis function that lead to inefficient regex processing.