Input validation bypass in dcmjs DS and IS value parsing
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
dcmjs before 0.52.0, a JavaScript implementation of DICOM manipulation, parses DecimalString and IntegerString values without checking finiteness or DICOM value rules (CWE-20). Scientific notation overflow can yield Infinity, and stripped signed infinity text can yield NaN, while IntegerString also accepts exponent notation and out-of-range values. Applications that trust these values can propagate invalid numbers into calculations, causing incorrect results or disrupted processing.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
Description from the CNA
dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validating finiteness or the DICOM value-representation rules. Scientific notation overflow in a DS or IS field can produce positive or negative Infinity, while stripping alphabetic characters from signed infinity text can leave a sign-only string that converts to NaN. IntegerString also accepts exponent notation and values outside the DICOM signed 32-bit IS range. Applications that trust these parsed values can propagate invalid numbers into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. This issue is fixed in version 0.52.0.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| dcmjs-org | dcmjs | before 0.52.0 | 0.52.0 | Patch available | CNA |
| — | dcmjs (npm) | before 0.52.0 | 0.52.0 | Patch available | GHSA-px68-xx5g-48q5 |
- dcmjs Vendordcmjs-org Affected before 0.52.0 Fixed in 0.52.0 Patch available CNA
- dcmjs (npm) Vendor— Affected before 0.52.0 Fixed in 0.52.0 Patch available GHSA-px68-xx5g-48q5
Remediation
Upgrade dcmjs to version 0.52.0 or later, which fixes this issue.
Written with Claude Haiku 5.5 from the sources below · 2026-11-05
- Fix · CNA dcmjs (dcmjs-org) Fixed in 0.52.0
- Fix · GHSA-px68-xx5g-48q5 dcmjs (npm) Fixed in 0.52.0 Advisory →
Timeline
- 2026-11-05 Threatist record created from CVE-2026-46350
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences