CVE-2026-52746: jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion
(updated )
Before JSONata 2.2.0 and 1.8.9, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.
References
- github.com/advisories/GHSA-86vw-mfpg-wwv9
- github.com/jsonata-js/jsonata/commit/80ba95d170f74e3f20f4f36b8b77d8c85cea7686
- github.com/jsonata-js/jsonata/commit/d6ffc17cb16a8e53c222205bd274624e919cce0b
- github.com/jsonata-js/jsonata/pull/782
- github.com/jsonata-js/jsonata/pull/793
- github.com/jsonata-js/jsonata/releases/tag/v1.8.9
- github.com/jsonata-js/jsonata/releases/tag/v2.2.0
- github.com/jsonata-js/jsonata/security/advisories/GHSA-86vw-mfpg-wwv9
- nvd.nist.gov/vuln/detail/CVE-2026-52746
Code Behaviors & Features
Detect and mitigate CVE-2026-52746 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →