Description
Before JSONata 2.2.0 and 1.8.9, it is possible to craft non-matching inputs to the $toMillis function that cause superlinear backtracking in the ISO-8601 validation regex. This may lead to denial of service in applications that evaluate user-provided JSONata expressions.
Recommendation
Update the jsonata package to the latest compatible version. Followings are version details:
Affected version(s): **< 1.8.9 >= 2.0.0, < 2.2.0** Patched version(s): **1.8.9 2.2.0**
References
Could your website be exposed too?
SmartScanner can check your website for jsonata: Malicious inputs to "$toMillis" function can cause resource exhaustion and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Fedify affected by resource exhaustion caused by unbounded redirect following during remote key/document resolution - CVE-2026-34148
- @anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion - CVE-2026-73561
- Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests - CVE-2025-53620
- jsrsasign: Division by Zero Allows Invalid JWK Modulus to Cause Deterministic Zero Output in RSA Operations - CVE-2026-4603
You might also like:
See something that needs correcting? Let us knowUpdated August 03, 2026