{"id":"CVE-2026-52746","title":"jsonata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion","summary":"jsonata: Malicious inputs to \"$toMillis\" function can cause resource exhaustion","severity":"high","cvss":7.5,"cwe":["CWE-1333"],"vendor":"jsonata","product":"jsonata","ecosystem":"npm","affected":["jsonata < 2.2.0"],"patched":["jsonata 2.2.0"],"published":"2026-07-02","updated":"2026-07-02","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-86vw-mfpg-wwv9","references":[{"url":"https://github.com/jsonata-js/jsonata/security/advisories/GHSA-86vw-mfpg-wwv9"},{"url":"https://github.com/jsonata-js/jsonata/pull/782"},{"url":"https://github.com/jsonata-js/jsonata/pull/793"},{"url":"https://github.com/jsonata-js/jsonata/commit/80ba95d170f74e3f20f4f36b8b77d8c85cea7686"},{"url":"https://github.com/jsonata-js/jsonata/commit/d6ffc17cb16a8e53c222205bd274624e919cce0b"},{"url":"https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0"},{"url":"https://github.com/advisories/GHSA-86vw-mfpg-wwv9"}],"tags":["ghsa","npm"],"ingestedAt":"2026-07-02T20:42:45.686Z","epss":0.00689,"epssPercentile":0.50643,"slug":"CVE-2026-52746","body":"## Overview\n\n### Impact\nIn JSONata `<v2.2.0`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.\n\n### Patches\nThis issue has been addressed in JSONata version >= 2.2.0 via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.\n\n### References\nhttps://github.com/jsonata-js/jsonata/releases/tag/v2.2.0\n\n### Credit\nThank you to Doruk Tan Öztürk for disclosing this issue.\n\n## Affected packages\n\n- `jsonata < 2.2.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `jsonata 2.2.0`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}