Junglewise Threat Intelligence

CVE-2026-52746: jsonata-js JSONata Denial of Service in $toMillis function

CVE-2026-52746 · Severity: high · CVSS 7.5 · Published 2026-07-17

Executive brief

JSONata is a popular library used to query and transform data. A flaw in how it processes date and time information allows an attacker to send specially crafted inputs that cause the system to freeze or crash. This can lead to a total service outage for any application that allows users to provide their own data transformation rules.

Technical details

A Regular Expression Denial of Service (ReDoS) vulnerability exists in JSONata versions prior to 2.2.0. The root cause is inefficient regex complexity (CWE-1333) within the ISO-8601 validation logic used by the $toMillis function. Specifically, the 'iso8601regex' pattern contained overlapping or poorly constrained groups that triggered superlinear backtracking when processing certain non-matching strings. An unauthenticated remote attacker can exploit this by providing a malicious expression or input string to an application that evaluates user-supplied JSONata queries. This results in high CPU consumption and a denial-of-service condition. The issue was resolved in version 2.2.0 by optimizing the regex pattern.

Affected products

  • jsonata-js JSONata < 2.2.0

Timeline

  • 2026-04-30: other: Initial fix for $toMillis fractional seconds merged
  • 2026-05-14: patched: Version 2.2.0 released with ISO8601 regex fix
  • 2026-05-29: advisory: GitHub Security Advisory published
  • 2026-07-17: disclosed: CVE published to NVD

References

Related threats