CVE-2026-52746: jsonata-js JSONata Denial of Service in $toMillis function

CVE-2026-52746 · Severity: high · CVSS 7.5 · Published 2026-07-17

JSONata is a popular library used to query and transform data. A flaw in how it processes date and time information allows an attacker to send specially crafted inputs that cause the system to freeze or crash. This can lead to a total service outage for any application that allows users to provide their own data transformation rules.

Technologies: JSONata, jsonata (npm). Vendors: JSONata, npm.

Quick answers

Is CVE-2026-52746 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52746 being exploited in the wild.
How severe is CVE-2026-52746?
High severity, with a CVSS score of 7.5, published 17 July 2026.
Which products and versions are affected?
JSONata < 2.2.0; jsonata (npm) SEMVER:introduced=2.0.0,fixed=2.2.0.
Is there a fix for CVE-2026-52746?
Yes. jsonata (npm): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52746 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-52746?
Check whether you run JSONata or jsonata (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • jsonata (npm): upgrade to 2.2.0 or later
    npm install jsonata@2.2.0

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in JSONata versions prior to 2.2.0. The root cause is inefficient regex complexity (CWE-1333) within the ISO-8601 validation logic used by the $toMillis function. Specifically, the 'iso8601regex' pattern contained overlapping or poorly constrained groups that triggered superlinear backtracking when processing certain non-matching strings. An unauthenticated remote attacker can exploit this by providing a malicious expression or input string to an application that evaluates user-supplied JSONata queries. This results in high CPU consumption and a denial-of-service condition. The issue was resolved in version 2.2.0 by optimizing the regex pattern.

Affected products

  • jsonata-js JSONata < 2.2.0

Identifiers

  • CVE-2026-52746
  • GHSA-86vw-mfpg-wwv9

Timeline

  • 2026-04-30: other: Initial fix for $toMillis fractional seconds merged
  • 2026-05-14: patched: Version 2.2.0 released with ISO8601 regex fix
  • 2026-05-29: advisory: GitHub Security Advisory published
  • 2026-07-17: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.