dcmjs CVE-2026-46350
LOW
GHSA-px68-xx5g-48q5
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSupply crafted DICOM object
-
Deliverydcmjs parses DS/IS field
-
Exploitsanitizer regex passes '1e999999' or '-'
-
ExecutionNumber() returns Infinity/NaN
-
Persistcorrupted value propagates downstream
-
Impactgeometry/dose corruption or viewer DoS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V2 - Validation and Business Logic Input validation, allowlisting
|
| Exploitation Conditions | Exploitation requires the host application to parse an attacker-supplied DICOM object through dcmjs < 0.52.0 whose DS (DecimalString) or IS (IntegerString) field contains scientific-notation overflow ('1e999999', '-1e999999', '1e18') or a sign-only remnant from a stripped infinity string ('-inf'/'+inf' reduced to '-'/'+'), causing Number() to yield Infinity or NaN. The limiting factor, per the maintainer, is that dcmjs enforces no trust boundary here: the corrupted NaN/Infinity only produces harm if the downstream consumer (e.g. OHIF Viewer, Cornerstone.js, a DICOMweb pipeline) fails to range-check parsed numeric values, which callers are expected to do regardless. No authentication is indicated (PR:N), but the attacker must get the malicious DICOM data into the processing path, and only versions below 0.52.0 are affected. |
| Impact | Signals conflict and point to a low-to-moderate real-world priority rather than an urgent one. The input carries a reporter-assigned CVSS of 7.5 HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), but the dcmjs maintainer explicitly rates it low, arguing that malformed input only yields NaN/Infinity in values the caller must range-check anyway, that both outcomes are reachable by other means, and that no dcmjs-enforced trust boundary is crossed - so the I:H/A:H impact rating is disputed at the source. The vuln.today Decision label is 'monitor', consistent with the maintainer view and against the raw HIGH score. No EPSS score, no CISA KEV listing, and no PoC/exploit reference are present in the input (only the GHSA advisory, the patch commit, and the release tag), so there is no public exploit identified at time of analysis and no evidence of active exploitation. The AV:N/PR:N/UI:N metrics suggest trivial remote reach, but exploitation is really contingent on a downstream application failing to range-check parsed numerics - a mechanism the evidence treats as the caller's responsibility, not dcmjs's. Net: patch during normal maintenance; this reads as a high-CVSS-but-lower-real-risk data-integrity/DoS issue, not an emergency. |
| Exploit ScenarioDerived | An attacker delivers a crafted DICOM object - for example over DICOMweb or as an uploaded study - whose DS or IS field (e.g. PixelSpacing or NumberOfFrames) contains '1e999999', '-1e999999', or '-inf'. When a dcmjs-based viewer or pipeline parses it, the sanitizer regex passes the characters and Number() returns Infinity or NaN, which then silently propagates through spatial, display, or dose arithmetic, corrupting measurements or rendering images unreadable (denial of service). No working public exploit is identified, though the advisory documents the exact trigger inputs. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Input validation bypass in dcmjs (npm package dcmjs) before 0.52.0 allows unauthenticated attackers to force Infinity or NaN into parsed DICOM DS (Decimal String) and IS (Integer String) numeric values by supplying scientific-notation overflow such as '1e999999' or a sign-only remnant produced when '-inf' is sanitized down to '-'. The corrupted numbers only cause harm where the downstream consumer - OHIF Viewer, Cornerstone.js or another DICOMweb pipeline built on dcmjs - fails to range-check parsed values, which the maintainer notes callers are expected to do regardless, so the practical severity depends on the host application rather than on dcmjs alone. Realistic outcomes are corrupted spatial geometry, windowing, rescale and dosimetry values, or frame-count overflow; no public exploit was identified at time of analysis and this CVE is not in CISA KEV, with the maintainer rating it low versus the reporter's 7.5 assessment.
RemediationAI
Vendor-released patch: dcmjs 0.52.0 (released 2026-05-19) - upgrade from any version below 0.52.0, following the release notes at https://github.com/dcmjs-org/dcmjs/releases/tag/v0.52.0; the fix commit is https://github.com/dcmjs-org/dcmjs/commit/81e7e11cdefb56aa1a65bfe259648b865583ff88 and the advisory is https://github.com/dcmjs-org/dcmjs/security/advisories/GHSA-px68-xx5g-48q5. Applications that consume dcmjs indirectly (OHIF Viewer, Cornerstone.js, DICOMweb pipelines) should pin the patched dcmjs version in their dependency tree or lockfile and verify the resolved version is 0.52.0 or later. Where updating cannot be done immediately, the maintainer's position is that consumers must range-check parsed DS/IS numeric values before use - rejecting non-finite results and enforcing PS3.5 bounds (IS within [-2^31, 2^31-1], DS within its 16-character fixed/floating-point form) - which also protects against other paths that produce NaN or Infinity; the trade-off is that this shifts validation responsibility to every downstream call site and any code path that forgets the check remains exposed.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
DICOM encodes numeric attributes as text: DS (Decimal String, PS3.5 §6.2) and IS (Integer String) carry decimal or integer values as ASCII characters rather than binary numbers. dcmjs implements these value representations in src/ValueRepresentation.js, where both the DecimalString and IntegerString classes apply the sanitizer numberStr.trim().replace(/[^0-9.\\\-+e]/gi, "") and then pass the result to JavaScript's Number() constructor. That character filter removes letters used by the literals 'NaN' and 'Infinity', but it deliberately preserves the characters needed for scientific notation, and it does not enforce any PS3.5 length or range limits. Three consequences follow: 'e' notation survives intact so Number('1e999999') yields Infinity; stripping '-inf' leaves a lone '-' or '+' which Number() converts to NaN; and IntegerString reuses the same permissive logic, accepting '1e5' and '1e18' despite PS3.5 restricting IS to the characters 0-9, + and '-' and to the range [-2^31, 2^31-1]. Because NaN and Infinity are IEEE 754 values that propagate silently through subsequent arithmetic, the defect is CWE-20 (Improper Input Validation) rather than a memory-safety issue; dcmjs enforces no trust boundary at this point, so whether the malformed value becomes a real fault is determined by the consuming viewer or pipeline.
Know when Node.js gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Remotely parseable attacker-supplied DICOM needs no auth or UI in automated pipelines, but harm is limited to NaN/Infinity the caller must range-check, so I:L/A:L and C:N rather than the reporter's I:H/A:H.
DescriptionCVE.org
dcmjs, a JavaScript library for DICOM manipulation used in web-based medical imaging viewers, contains an input validation bypass in its handling of DS (Decimal String) and IS (Integer String) value representations.
The DecimalString and IntegerString classes in ValueRepresentation.js use a regex sanitizer followed by JavaScript's Number() constructor. While the regex strips direct NaN/Infinity strings, it preserves scientific notation (including the 'e' character), enabling:
- Infinity injection via scientific notation overflow (1e999999)
- NaN injection via sign-only remnants from stripped inf strings ("-inf" -> "-")
- IS accepting scientific notation in violation of PS3.5
AFFECTED PRODUCT ==== Product: dcmjs (JavaScript DICOM manipulation library) Repository: https://github.com/dcmjs-org/dcmjs npm: https://www.npmjs.com/package/dcmjs Affected Versions: < 0.52.0 (patched in 0.52.0, released 2026-05-19) CVE: CVE-2026-46350 (assigned by GitHub 2026-05-13) CWE: CWE-20 (Improper Input Validation) CVSS Score: 7.5 (HIGH) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Maintainer note: The CVSS score above is the reporter's assessment; dcmjs rates this low, because malformed input produces NaN/Infinity in values the caller must range-check in any case (both are reachable by other means, and no trust boundary enforced by dcmjs is crossed).
DOWNSTREAM IMPACT ===== dcmjs is a foundational library used by:
- OHIF Viewer (Open Health Imaging Foundation)
- Cornerstone.js ecosystem
- DICOMweb client/server implementations
- Research and clinical web-based PACS viewers
- Any Node.js or browser application parsing DICOM via dcmjs
ROOT CAUSE == In src/ValueRepresentation.js, both DecimalString and IntegerString use:
let returnVal = numberStr.trim().replace(/[^0-9.\\\-+e]/gi, ""); return returnVal === "" ? null : Number(returnVal);
The regex /[^0-9.\\\-+e]/gi strips characters NOT in the set {0-9, ., \, -, +, e, E}. This provides partial defense: direct "NaN" and "Infinity" strings are stripped to empty/null. However:
(a) Scientific notation is fully preserved because 'e', digits, '+', '-', '.' all pass the regex. "1e999999" passes intact, and Number("1e999999") returns JavaScript Infinity.
(b) The string "-inf" is stripped to just "-" (only the minus passes the regex). Number("-") returns JavaScript NaN.
(c) IntegerString uses the SAME regex/logic as DecimalString, meaning IS accepts scientific notation ("1e5" -> 100000) in violation of PS3.5 Section 6.2, which restricts IS to characters 0-9, +, -.
(d) No range validation exists for IS values (PS3.5 requires [-2^31, 2^31-1]) or DS values (16-character max, fixed/floating-point only).
VULNERABILITY DETAILS =====
Attack Vector 1: Infinity via Scientific Notation Overflow ---------------------------------------------------------- Input: DS or IS field containing "1e999999" Regex: Passes (all chars in allowed set) Result: Number("1e999999") -> Infinity Impact: Infinity propagates through all downstream arithmetic
Attack Vector 2: Negative Infinity via Scientific Notation ---------------------------------------------------------- Input: DS or IS field containing "-1e999999" Regex: Passes Result: Number("-1e999999") -> -Infinity Impact: Negative Infinity in spatial/dosimetric calculations
Attack Vector 3: NaN via Sign-Only Remnant ------------------------------------------ Input: DS or IS field containing "-inf" Regex: Strips to "-" Result: Number("-") -> NaN Impact: NaN propagates silently through arithmetic (IEEE 754)
Attack Vector 4: NaN via Plus-Only Remnant ------------------------------------------ Input: DS or IS field containing "+inf" Regex: Strips to "+" Result: Number("+") -> NaN Impact: Same as above
Attack Vector 5: IS Scientific Notation Bypass ----------------------------------------------- Input: IS field containing "1e5" Regex: Passes Result: Number("1e5") -> 100000 Impact: Integer fields accept non-integer representation, violating PS3.5
Attack Vector 6: IS Extreme Overflow ------------------------------------- Input: IS field containing "1e18" Regex: Passes Result: Number("1e18") -> 1000000000000000000 Impact: Far exceeds IS range [-2^31, 2^31-1], no bounds check
CLINICAL IMPACT === dcmjs is used in web-based DICOM viewers and processing pipelines. Corrupted values affect:
- PixelSpacing / ImagePositionPatient: Spatial geometry corruption prevents
accurate measurement and registration in web viewers
- WindowCenter / WindowWidth: Display pipeline corruption makes images
unreadable (all black or all white)
- DoseGridScaling / NumberOfFrames: Radiation therapy dose display errors
and denial of service via frame count overflow
- RescaleSlope / RescaleIntercept: Hounsfield unit conversion produces
invalid values, corrupting quantitative analysis
- SliceThickness: Volume reconstruction fails in multiplanar reformats
Threat Intelligence Overview
CVE.org
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Exploit-DB