CVE-2026-46350

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

Published

2026-10-27

Modified

2026-10-27

Aliases

GHSA-px68-xx5g-48q5

Sources

github-advisory

Summary

dcmjs, a JavaScript library for DICOM manipulation used in web-based medical imaging viewers, contains an input validation bypass in its handling of DS (Decimal String) and IS (Integer String) value representations. The DecimalString and IntegerString classes in ValueRepresentation.js use a regex sanitizer followed by JavaScript's Number() constructor. While the regex strips direct NaN/Infinity strings, it preserves scientific notation (including the 'e' character), enabling: 1. Infinity injection via scientific notation overflow (1e999999) 2. NaN injection via sign-only remnants from stripped inf strings ("-inf" -> "-") 3. IS accepting scientific notation in violation of PS3.5 AFFECTED PRODUCT ================ Product: dcmjs (JavaScript DICOM manipulation library) Repository: https://github.com/dcmjs-org/dcmjs npm: https://www.npmjs.com/package/dcmjs Affected Versions: 100000) in violation of PS3.5 Section 6.2, which restricts IS to characters 0-9, +, -. (d) No range validation exists for IS values (PS3.5 requires [-2^31, 2^31-1]) or DS values (16-character max, fixed/floating-point only). VULNERABILITY DETAILS ===================== Attack Vector 1: Infinity via Scientific Notation Overflow ---------------------------------------------------------- Input: DS or IS field containing "1e999999" Regex: Passes (all chars in allowed set) Result: Number("1e999999") -> Infinity Impact: Infinity propagates through all downstream arithmetic Attack Vector 2: Negative Infinity via Scientific Notation ---------------------------------------------------------- Input: DS or IS field containing "-1e999999" Regex: Passes Result: Number("-1e999999") -> -Infinity Impact: Negative Infinity in spatial/dosimetric calculations Attack Vector 3: NaN via Sign-Only Remnant ------------------------------------------ Input: DS or IS field containing "-inf" Regex: Strips to "-" Result: Number("-") -> NaN Impact: NaN propagates silently through arithmetic (IEEE 754) Attack Vector 4: NaN via Plus-Only Remnant ------------------------------------------ Input: DS or IS field containing "+inf" Regex: Strips to "+" Result: Number("+") -> NaN Impact: Same as above Attack Vector 5: IS Scientific Notation Bypass -------

Affected packages

Remediation: Upgrade to 0.52.0 or later.

References

• https://github.com/advisories/GHSA-px68-xx5g-48q5