---
id: CVE-2026-52746
title: >-
  jsonata: Malicious inputs to "$toMillis" function can cause resource
  exhaustion
summary: >-
  jsonata: Malicious inputs to "$toMillis" function can cause resource
  exhaustion
severity: high
cvss: 7.5
cwe:
  - CWE-1333
vendor: jsonata
product: jsonata
ecosystem: npm
affected:
  - jsonata < 2.2.0
patched:
  - jsonata 2.2.0
published: '2026-07-02'
updated: '2026-07-02'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-86vw-mfpg-wwv9'
references:
  - url: >-
      https://github.com/jsonata-js/jsonata/security/advisories/GHSA-86vw-mfpg-wwv9
  - url: 'https://github.com/jsonata-js/jsonata/pull/782'
  - url: 'https://github.com/jsonata-js/jsonata/pull/793'
  - url: >-
      https://github.com/jsonata-js/jsonata/commit/80ba95d170f74e3f20f4f36b8b77d8c85cea7686
  - url: >-
      https://github.com/jsonata-js/jsonata/commit/d6ffc17cb16a8e53c222205bd274624e919cce0b
  - url: 'https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0'
  - url: 'https://github.com/advisories/GHSA-86vw-mfpg-wwv9'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-02T20:42:45.686Z'
epss: 0.00689
epssPercentile: 0.5081
---

## Overview

### Impact
In JSONata `<v2.2.0`, it is possible to craft non-matching inputs to the [$toMillis](https://docs.jsonata.org/date-time-functions#tomillis) function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.

### Patches
This issue has been addressed in JSONata version >= 2.2.0 via fixes that include https://github.com/jsonata-js/jsonata/pull/782 and https://github.com/jsonata-js/jsonata/pull/793. Applications that evaluate user-provided expressions should update ASAP to prevent exploitation.

### References
https://github.com/jsonata-js/jsonata/releases/tag/v2.2.0

### Credit
Thank you to Doruk Tan Öztürk for disclosing this issue.

## Affected packages

- `jsonata < 2.2.0`

## Remediation

Upgrade to a patched release:

- `jsonata 2.2.0`