CVE-2026-52746
High · 7.5CVSS
7.5
EPSS
0.7%
Published
Jul 17, 2026
CISA due date
—
The record
JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non-matching inputs to the $toMillis function can cause superlinear backtracking in the ISO-8601 validation regex, leading to denial of service in applications that evaluate user-provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-121577 Inefficient Regular Expression Complexity (CWE-1333) in generate_regex()… CWE-1333
- CVE-2026-120217 A vulnerability was detected in Delgan loguru 0.7.3. CWE-1333
- CVE-2026-62864 Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack. CWE-1333
- CVE-2026-119300 Wekan is open source kanban built with Meteor. CWE-1333
- CVE-2026-118993 CallBackery versions before 0.62.0 for Perl allow denial of service via the request path… CWE-1333
- CVE-2026-115866 Starlet versions from 0.20 before 0.33 for Perl allow CPU exhaustion via regular… CWE-1333
- CVE-2026-119202 @hapi/content provides HTTP Content-* header parsing. CWE-1333
- CVE-2026-118779 Forge (also called node-forge) is a native implementation of Transport Layer Security in… CWE-1333