{"id":"CVE-2026-52746","aliases":["EUVD-2026-45253","GHSA-86vw-mfpg-wwv9"],"status":"published","title":"JSONata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion","description":"JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00689,"percentile":0.5325,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-07-02T20:13:55Z","modified":"2026-10-28T02:30:54Z","fixes":[{"ecosystem":"npm","package":"jsonata","fixed_in":["2.2.0","1.8.9"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"jsonata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"jsonata","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.9"}]}]},{"source":"osv","ecosystem":"npm","package":"jsonata","ranges":[{"type":"SEMVER","events":[{"introduced":"2.0.0"},{"fixed":"2.2.0"}]}]},{"source":"osv","ecosystem":"npm","package":"jsonata","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.8.9"}]}]}],"products":[{"vendor":"jsonata","product":"jsonata"},{"vendor":"jsonata-js","product":"jsonata"}],"references":[{"url":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-86vw-mfpg-wwv9","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/jsonata-js/jsonata/pull/782","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/jsonata-js/jsonata/pull/793","tags":["x_refsource_MISC","Issue Tracking","Patch","fix","web"]},{"url":"https://github.com/jsonata-js/jsonata/commit/80ba95d170f74e3f20f4f36b8b77d8c85cea7686","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/jsonata-js/jsonata/commit/d6ffc17cb16a8e53c222205bd274624e919cce0b","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/jsonata-js/jsonata/releases/tag/v1.8.9","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0","tags":["x_refsource_MISC","Product","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-52746","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-86vw-mfpg-wwv9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/52xxx/CVE-2026-52746.json","tags":["advisory"]},{"url":"https://github.com/jsonata-js/jsonata","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-52746","title":"JSONata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion","description":"JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.","status":"published","published":"2026-07-17T18:32:47.173Z","modified":"2026-08-03T20:50:28.984Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T13:40:57.334596Z"}],"euvd":[{"id":"EUVD-2026-45253","description":"JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.","status":"published","published":"2026-07-17T18:32:47Z","modified":"2026-08-03T20:50:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:02:23.68186Z"}],"ghsa":[{"id":"GHSA-86vw-mfpg-wwv9","title":"jsonata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion","description":"### Impact\nBefore JSONata `2.2.0` and `1.8.9`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.\n\n### Patches\nThis issue has been addressed in JSONata version 2.2.0 or later, and 1.8.9 or later on v1, via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.\n\n### References\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.0\nhttps://github.com/jsonata-js/jsonata/releases/tag/v1.8.9\n\n### Credit\nThank you to Doruk Tan Öztürk for disclosing this issue.","status":"published","published":"2026-07-02T20:13:55Z","modified":"2026-08-03T20:49:58Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:40:55.903445Z"}],"nvd":[{"id":"CVE-2026-52746","description":"JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.","status":"published","published":"2026-07-17T19:17:16.5Z","modified":"2026-10-24T20:10:00.137Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:30.250437Z"}],"osv":[{"id":"CVE-2026-52746","title":"JSONata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion","description":"JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.","status":"published","published":"2026-07-17T18:32:47.173Z","modified":"2026-10-28T02:30:54.707800592Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:45:07.431113Z"},{"id":"GHSA-86vw-mfpg-wwv9","title":"jsonata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion","description":"### Impact\nBefore JSONata `2.2.0` and `1.8.9`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.\n\n### Patches\nThis issue has been addressed in JSONata version 2.2.0 or later, and 1.8.9 or later on v1, via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.\n\n### References\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.0\nhttps://github.com/jsonata-js/jsonata/releases/tag/v1.8.9\n\n### Credit\nThank you to Doruk Tan Öztürk for disclosing this issue.","status":"published","published":"2026-07-02T20:13:55Z","modified":"2026-08-03T21:00:22.986728376Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:42.077781Z"}]}}