CVE-2026-46350 json
dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS
published 13d ago modified 7h ago also EUVD-2026-117784 , GHSA-px68-xx5g-48q5
- cvss
- 9.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 48%
- public exploits
- 0
- none known
Summary
dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validating finiteness or the DICOM value-representation rules. Scientific notation overflow in a DS or IS field can produce positive or negative Infinity, while stripping alphabetic characters from signed infinity text can leave a sign-only string that converts to NaN. IntegerString also accepts exponent notation and values outside the DICOM signed 32-bit IS range. Applications that trust these parsed values can propagate invalid numbers into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. This issue is fixed in version 0.52.0.
Patch / fix
- npm dcmjs 0.52.0
- github.com/dcmjs-org/dcmjs@81e7e11 commit
- github.com/dcmjs-org/dcmjs#497 pull request
- github.com/dcmjs-org/dcmjs/releases/tag/v0.52.0 release
Is CVE-2026-46350 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 8h ago
Exploit prediction
0.60% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | dcmjs | <0.52.0 |
0.52.0 |
Affected products
- dcmjs-org dcmjs
Classification
References
Sources
- CVE List CVE-2026-46350
- GitHub Advisory GHSA-px68-xx5g-48q5
- NVD CVE-2026-46350
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.