p PatchFirst

CVE-2026-52746

CVE-2026-52746 · JSONata: Malicious inputs to "$toMillis" function can cause resource exhaustion

This page contains facts from public vulnerability sources. Check the original advisory before updating.

JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.

CVSS 7.5 · High · EPSS 0.7% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • jsonata

    Versions
    • >= 2.0.0, < 2.2.0: Affected
    • < 1.8.9: Affected

    No fix published

  • jsonata npm

    Affected ranges
    • SEMVER: ≥ 2.0.0, < 2.2.0

    Update to 2.2.0

  • jsonata npm

    Affected ranges
    • SEMVER: < 1.8.9

    Update to 1.8.9

Original sources

Check your server →