jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion

Description

Before JSONata 2.2.0 and 1.8.9, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.

Recommendation

Update the jsonata package to the latest compatible version. Followings are version details:

• Affected version(s): **< 1.8.9

  >= 2.0.0, < 2.2.0**

• Patched version(s): **1.8.9

  2.2.0**

References

• GHSA-86vw-mfpg-wwv9
• CVE-2026-52746
• CWE-1333
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution - CVE-2026-34148
• @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion - CVE-2026-73561
• Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests - CVE-2025-53620
• jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations - CVE-2026-4603

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

jsonata