CVE-2026-52746: JSONata $toMillis DoS Vulnerability

CVE-2026-52746 Overview

JSONata is a widely used JSON query and transformation language. CVE-2026-52746 is a Regular Expression Denial of Service (ReDoS) vulnerability in JSONata versions prior to 2.2.0. Malicious non-matching inputs passed to the $toMillis function trigger superlinear backtracking in the ISO-8601 validation regular expression. Applications that evaluate user-provided JSONata expressions can be forced into extended CPU consumption, resulting in denial of service. The issue is tracked under CWE-1333 (Inefficient Regular Expression Complexity) and is fixed in JSONata 2.2.0.

Critical Impact
Remote, unauthenticated attackers can send crafted strings to $toMillis and cause sustained CPU exhaustion, disrupting availability of any service that evaluates untrusted JSONata expressions.

Affected Products

JSONata (jsonata-js) versions prior to 2.2.0
Node.js and JavaScript applications that evaluate user-supplied JSONata expressions
Downstream platforms embedding JSONata for JSON transformation (integration/iPaaS, low-code, workflow engines)

Discovery Timeline

2026-07-17 - CVE-2026-52746 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-52746

Vulnerability Analysis

The flaw resides in src/datetime.js, where JSONata validates ISO-8601 timestamps before conversion in the $toMillis built-in function. The original regular expression used repeated quantifier groups with overlapping optional segments ((-[01]\d)*(-[0-3]\d)*(T[0-2]\d:[0-5]\d:[0-5]\d)*). When a non-matching input is crafted to force the regex engine to explore many alternative match paths, the engine performs superlinear backtracking. Evaluation time scales non-linearly with input length, tying up the JavaScript event loop.

Root Cause

The root cause is inefficient regular expression complexity in the iso8601regex pattern. Using unbounded * quantifiers on structurally similar optional segments allowed catastrophic backtracking on adversarial inputs. A secondary issue affected parsing of fractional seconds with more than three digits, which the maintainers addressed in the same release.

Attack Vector

Exploitation requires only that an attacker submit a JSONata expression, or input to an expression, that reaches $toMillis with an attacker-controlled string. No authentication or user interaction is needed when the host application accepts untrusted expressions or timestamp data. A single request can pin a worker thread, and repeated requests amplify the impact into a full denial-of-service condition.

javascript

// Security patch in src/datetime.js - fix iso8601 regex pattern (#793)
// Replaces unbounded '*' quantifiers with bounded '?' to prevent
// catastrophic backtracking on adversarial inputs to $toMillis.

// Regular expression to match an ISO 8601 formatted timestamp
- var iso8601regex = new RegExp('^\\d{4}(-[01]\\d)*(-[0-3]\\d)*(T[0-2]\\d:[0-5]\\d:[0-5]\\d)*(\\.\\d+)?([+-][0-2]\\d:?[0-5]\\d|Z)?$');
+ var iso8601regex = new RegExp('^\\d{4}(-[01]\\d)?(-[0-3]\\d)?(T[0-2]\\d:[0-5]\\d:[0-5]\\d)?(\\.\\d+)?([+-][0-2]\\d:?[0-5]\\d|Z)?$');

// Source: https://github.com/jsonata-js/jsonata/commit/d6ffc17cb16a8e53c222205bd274624e919cce0b

Detection Methods for CVE-2026-52746

Indicators of Compromise

Sustained single-core CPU saturation in Node.js processes handling JSONata evaluation.
Elevated request latency or timeouts on endpoints that accept JSONata expressions or ISO-8601 timestamp inputs.
Repeated inbound payloads containing long, malformed date-like strings targeting fields parsed by $toMillis.
Event loop lag spikes reported by Node.js runtime metrics or APM tooling.

Detection Strategies

Inventory dependencies for jsonata package versions below 2.2.0 using SCA tooling or npm ls jsonata.
Add application-layer logging around JSONata expression evaluation, capturing input length, evaluation duration, and failure mode.
Alert on JSONata evaluations that exceed a defined execution-time threshold (for example, 250 ms).
Fuzz test JSONata-facing endpoints with malformed ISO-8601 strings to surface latency anomalies before production exposure.

Monitoring Recommendations

Track per-request CPU time and event loop delay metrics for services exposing JSONata evaluation.
Monitor error rates and 5xx timeouts on API routes that accept user-supplied transformation expressions.
Correlate CPU saturation events with request payloads to identify adversarial ISO-8601 inputs.
Review WAF and API gateway logs for repeated long alphanumeric strings submitted to timestamp fields.

How to Mitigate CVE-2026-52746

Immediate Actions Required

Upgrade JSONata to version 2.2.0 or later across all applications and container images.
Audit application code paths that pass untrusted input to $toMillis or that evaluate user-supplied JSONata expressions.
Enforce input length limits and strict server-side validation on any field converted with $toMillis.
Deploy per-evaluation execution timeouts and worker-thread isolation for JSONata processing.

Patch Information

The fix is delivered in JSONata 2.2.0. Two commits address the underlying issues: 80ba95d1 corrects handling of fractional seconds beyond three digits, and d6ffc17c replaces vulnerable * quantifiers with ? in the iso8601regex. See the GitHub Security Advisory GHSA-86vw-mfpg-wwv9, GitHub Release v2.2.0, Pull Request #782, and Pull Request #793 for full details.

Workarounds

Reject or truncate timestamp inputs longer than the maximum valid ISO-8601 length (approximately 30 characters) before passing them to $toMillis.
Execute JSONata evaluation in a Node.js worker thread with a hard timeout to bound worst-case CPU consumption.
Disallow user-supplied JSONata expressions where feasible; accept only server-defined transformations parameterized by validated inputs.
Deploy WAF rules that block excessively long strings submitted to endpoints known to invoke $toMillis.

bash

# Upgrade JSONata to the patched release
npm install jsonata@^2.2.0

# Verify the resolved version in production dependencies
npm ls jsonata

# Optional: audit workspace for vulnerable transitive versions
npm audit --production