{"id":"CVE-2026-46350","kind":"vulnerability","aliases":["CVE-2026-46350","GHSA-px68-xx5g-48q5"],"related":[],"title":"dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS","description":"dcmjs, a JavaScript library for DICOM manipulation used in web-based medical\nimaging viewers, contains an input validation bypass in its handling of DS\n(Decimal String) and IS (Integer String) value representations.\n\nThe DecimalString and IntegerString classes in ValueRepresentation.js use a\nregex sanitizer followed by JavaScript's Number() constructor. While the regex\nstrips direct NaN/Infinity strings, it preserves scientific notation (including\nthe 'e' character), enabling:\n\n  1. Infinity injection via scientific notation overflow (1e999999)\n  2. NaN injection via sign-only remnants from stripped inf strings (\"-inf\" -> \"-\")\n  3. IS accepting scientific notation in violation of PS3.5\n\nAFFECTED PRODUCT\n================\nProduct:          dcmjs (JavaScript DICOM manipulation library)\nRepository:       https://github.com/dcmjs-org/dcmjs\nnpm:              https://www.npmjs.com/package/dcmjs\nAffected Versions: < 0.52.0 (patched in 0.52.0, released 2026-05-19)\nCVE:              CVE-2026-46350 (assigned by GitHub 2026-05-13)\nCWE:              CWE-20 (Improper Input Validation)\nCVSS Score:       7.5 (HIGH)\nCVSS Vector:      CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H\nMaintainer note:  The CVSS score above is the reporter's assessment; dcmjs rates this low, because malformed input produces NaN/Infinity in values the caller must range-check in any case (both are reachable by other means, and no trust boundary enforced by dcmjs is crossed).\n\nDOWNSTREAM IMPACT\n=================\ndcmjs is a foundational library used by:\n  - OHIF Viewer (Open Health Imaging Foundation)\n  - Cornerstone.js ecosystem\n  - DICOMweb client/server implementations\n  - Research and clinical web-based PACS viewers\n  - Any Node.js or browser application parsing DICOM via dcmjs\n\nROOT CAUSE\n==========\nIn src/ValueRepresentation.js, both DecimalString and IntegerString use:\n\n    let returnVal = numberStr.trim().replace(/[^0-9.\\\\\\-+e]/gi, \"\");\n    return returnVal === \"\" ? null : Number(returnVal);\n\nThe regex /[^0-9.\\\\\\-+e]/gi strips characters NOT in the set {0-9, ., \\, -, +,\ne, E}. This provides partial defense: direct \"NaN\" and \"Infinity\" strings are\nstripped to empty/null. However:\n\n  (a) Scientific notation is fully preserved because 'e', digits, '+', '-', '.'\n      all pass the regex. \"1e999999\" passes intact, and Number(\"1e999999\")\n      returns JavaScript Infinity.\n\n  (b) The string \"-inf\" is stripped to just \"-\" (only the minus passes the\n      regex). Number(\"-\") returns JavaScript NaN.\n\n  (c) IntegerString uses the SAME regex/logic as DecimalString, meaning IS\n      accepts scientific notation (\"1e5\" -> 100000) in violation of PS3.5\n      Section 6.2, which restricts IS to characters 0-9, +, -.\n\n  (d) No range validation exists for IS values (PS3.5 requires [-2^31, 2^31-1])\n      or DS values (16-character max, fixed/floating-point only).\n\nVULNERABILITY DETAILS\n=====================\n\nAttack Vector 1: Infinity via Scientific Notation Overflow\n----------------------------------------------------------\nInput:   DS or IS field containing \"1e999999\"\nRegex:   Passes (all chars in allowed set)\nResult:  Number(\"1e999999\") -> Infinity\nImpact:  Infinity propagates through all downstream arithmetic\n\nAttack Vector 2: Negative Infinity via Scientific Notation\n----------------------------------------------------------\nInput:   DS or IS field containing \"-1e999999\"\nRegex:   Passes\nResult:  Number(\"-1e999999\") -> -Infinity\nImpact:  Negative Infinity in spatial/dosimetric calculations\n\nAttack Vector 3: NaN via Sign-Only Remnant\n------------------------------------------\nInput:   DS or IS field containing \"-inf\"\nRegex:   Strips to \"-\"\nResult:  Number(\"-\") -> NaN\nImpact:  NaN propagates silently through arithmetic (IEEE 754)\n\nAttack Vector 4: NaN via Plus-Only Remnant\n------------------------------------------\nInput:   DS or IS field containing \"+inf\"\nRegex:   Strips to \"+\"\nResult:  Number(\"+\") -> NaN\nImpact:  Same as above\n\nAttack Vector 5: IS Scientific Notation Bypass\n-----------------------------------------------\nInput:   IS field containing \"1e5\"\nRegex:   Passes\nResult:  Number(\"1e5\") -> 100000\nImpact:  Integer fields accept non-integer representation, violating PS3.5\n\nAttack Vector 6: IS Extreme Overflow\n-------------------------------------\nInput:   IS field containing \"1e18\"\nRegex:   Passes\nResult:  Number(\"1e18\") -> 1000000000000000000\nImpact:  Far exceeds IS range [-2^31, 2^31-1], no bounds check\n\nCLINICAL IMPACT\n===============\ndcmjs is used in web-based DICOM viewers and processing pipelines.\nCorrupted values affect:\n\n  - PixelSpacing / ImagePositionPatient: Spatial geometry corruption prevents\n    accurate measurement and registration in web viewers\n\n  - WindowCenter / WindowWidth: Display pipeline corruption makes images\n    unreadable (all black or all white)\n\n  - DoseGridScaling / NumberOfFrames: Radiation therapy dose display errors\n    and denial of service via frame count overflow\n\n  - RescaleSlope / RescaleIntercept: Hounsfield unit conversion produces\n    invalid values, corrupting quantitative analysis\n\n  - SliceThickness: Volume reconstruction fails in multiplanar reformats","summary":"The dcmjs DICOM library turns scientific-notation and sign-only DS/IS strings into Infinity or NaN instead of rejecting them. A crafted DICOM file can therefore inject non-finite numbers into imaging geometry, window and dose values.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dcmjs","fixed":["0.52.0"],"affected":"< 0.52.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["browser","cwe-20","dcmjs","dicomweb","medical-imaging","node.js","npm","package"],"not_affected_if":["dcmjs-0.52.0-or-later","no-untrusted-dicom-input"],"how_to_check":"- Run `npm ls dcmjs` in each project and check whether the resolved version is below `0.52.0`.\n- Check lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for `dcmjs` entries below `0.52.0`.","fix":"- Upgrade `dcmjs` to `0.52.0` or later.\n- Range-check numeric DICOM values in your own code regardless of library version, since the maintainer says callers must validate anyway.","status":"open","published_at":"2026-10-27T13:29:57+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","triaged_at":"2026-10-27T13:32:25+00:00","updated_at":"2026-10-27T13:32:25+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T13:32:25Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `dcmjs` to `0.52.0` or later.\n- Range-check numeric DICOM values in your own code regardless of library version, since the maintainer says callers must validate anyway.","reach":"unknown","title":"dcmjs: DICOM DS and IS fields accept Infinity and NaN values","impact":"low","summary":"The dcmjs DICOM library turns scientific-notation and sign-only DS/IS strings into Infinity or NaN instead of rejecting them. A crafted DICOM file can therefore inject non-finite numbers into imaging geometry, window and dose values.","category":"package","nicknames":[],"who_cares":["npm","dcmjs","medical-imaging","dicomweb","browser","node.js"],"confidence":0.7,"needs_auth":"no","worst_case":"Non-finite numbers corrupt imaging geometry and display values silently","analyst_note":"","how_to_check":"- Run `npm ls dcmjs` in each project and check whether the resolved version is below `0.52.0`.\n- Check lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for `dcmjs` entries below `0.52.0`.","needs_analyst":false,"not_affected_if":["dcmjs-0.52.0-or-later","no-untrusted-dicom-input"],"who_is_affected":"Applications that parse DICOM files with dcmjs in Node.js or the browser, including web viewers and DICOMweb pipelines that build on it. The maintainer rates it low because malformed input yields NaN or Infinity that callers must range-check anyway, and no trust boundary is crossed. Projects that do not parse untrusted DICOM with dcmjs can skip it.","user_interaction":"unknown","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000856,"input_tokens":5374,"output_tokens":637,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-05':191C,201C '-1':443C '-13':202C '-19':192C '-1e999999':501C,506C '-2':439C '-20':22B,205C '-2026':9A,17A,195C '-46350':10A,18A,196C '-9':323C,334C,344C,428C '/av':217C '/dcmjs-org/dcmjs':178C '/gi':325C,336C '/package/dcmjs':182C '0':322C,333C,343C,427C '0.52.0':185C,188C '1':137C,456C '100000':415C '16':447C '1e5':414C '1e999999':144C,374C,379C,468C,478C '2':145C,441C,489C '2026':190C,200C '3':158C,516C '3.1':216C '31':440C,442C '4':546C '48q5':15A '5':572C '6.2':421C '7.5':211C '754':543C 'accept':160C,411C 'affect':167C,183C 'allow':474C 'applic':304C 'arithmet':486C,541C 'assess':236C 'assign':197C 'attack':454C,487C,514C,544C,570C 'b':383C 'base':82C,297C 'boundari':266C 'browser':20B,303C 'bypass':7A,90C,576C 'c':401C 'calcul':513C 'caller':249C 'case':256C 'caus':310C 'char':472C 'charact':135C,338C,426C,448C 'check':253C 'class':108C 'client/server':290C 'clinic':294C 'constructor':120C 'contain':86C,467C,500C,528C,558C 'cornerstone.js':287C 'craft':54B 'cross':271C 'cve':8A,16A,193C,194C 'cvss':209C,213C,215C,229C 'cwe':21B,203C,204C 'd':429C 'dcmjs':1A,19A,23B,32B,71C,170C,237C,269C,274C,308C 'decim':96C 'decimalstr':105C,314C,408C 'defens':350C 'detail':453C 'dicom':33B,55B,76C,172C,306C 'dicomweb':24B,289C 'digit':369C 'direct':125C,351C 'dose':69B 'downstream':272C,485C 'ds':95C,445C,463C,496C,524C,554C 'ds/is':2A,43B 'e':134C,324C,335C,345C,346C,368C 'ecosystem':288C 'empty/null':359C 'enabl':136C 'enforc':267C 'exist':433C 'field':466C,499C,527C,557C 'file':56B 'finit':62B 'fixed/floating-point':450C 'follow':115C 'foundat':277C,286C 'fulli':365C 'geometri':66B 'ghsa':12A 'ghsa-px68-xx5g-48q5':11A 'github':199C 'github.com':177C 'github.com/dcmjs-org/dcmjs':176C 'h':225C 'h/a':224C 'handl':93C 'health':284C 'high':212C 'howev':360C 'ieee':542C 'imag':27B,65B,84C,285C 'impact':273C,480C,508C,536C,566C 'implement':291C 'improp':206C 'includ':132C 'inf':155C,157C,386C,529C,559C 'infin':46B,138C,354C,382C,457C,479C,481C,491C,507C,510C 'inject':59B,139C,147C 'input':5A,88C,207C,243C,462C,495C,523C,553C 'instead':49B 'intact':376C 'integ':100C 'integerstr':107C,316C,402C 'javascript':73C,117C,171C,381C,399C 'l/pr':219C 'let':318C 'librari':34B,74C,174C,278C 'low':240C 'maintain':226C 'malform':242C 'manipul':77C,173C 'max':449C 'mean':262C,409C 'medic':26B,83C 'medical-imag':25B 'minus':393C 'must':250C 'n/ac':218C 'n/i':223C 'n/s':221C 'n/ui':220C 'nan':48B,146C,352C,400C,517C,535C,537C,547C,565C 'nan/infinity':126C,245C 'negat':490C,509C 'node.js':28B,301C 'non':61B 'non-finit':60B 'notat':38B,131C,142C,162C,363C,413C,460C,494C,575C 'note':227C 'npm':29B,179C 'null':328C 'number':63B,119C,329C,378C,397C,477C,505C,534C,564C 'numberstr.trim':320C 'ohif':281C 'open':283C 'overflow':143C,461C 'pac':298C 'packag':30B 'pars':305C 'partial':349C 'pass':371C,375C,394C,470C,503C 'patch':186C 'plus':550C 'plus-on':549C 'preserv':129C,366C 'produc':244C 'product':168C,169C 'propag':482C,538C 'provid':348C 'ps3.5':166C,419C,437C 'px68':13A 'rang':252C,431C 'range-check':251C 'rate':238C 'reachabl':259C 'regex':113C,123C,332C,373C,396C,469C,502C,530C,560C 'regex/logic':406C 'reject':51B 'releas':189C 'remnant':152C,522C,552C 'replac':321C 'report':234C 'repositori':175C 'represent':4A,103C 'requir':438C 'research':292C 'restrict':423C 'result':476C,504C,533C,563C 'return':326C,380C,398C 'returnv':319C,327C,330C 'root':309C 'sanit':114C 'scientif':37B,130C,141C,161C,362C,412C,459C,493C,574C 'scientific-not':36B 'score':210C,230C 'section':420C 'set':342C,475C 'sign':41B,150C,520C 'sign-on':40B,149C,519C 'silent':539C 'spatial/dosimetric':512C 'src/valuerepresentation.js':312C 'string':44B,97C,101C,127C,156C,355C,385C 'strip':124C,154C,337C,357C,388C,531C,561C 'therefor':58B 'trust':265C 'turn':35B 'u/c':222C 'use':78C,111C,279C,317C,403C 'valid':6A,89C,208C,432C 'valu':3A,70B,102C,247C,436C,446C 'valuerepresentation.js':110C 'vector':214C,455C,488C,515C,545C,571C 'version':184C 'via':140C,148C,307C,458C,492C,518C,548C 'viewer':85C,282C,299C 'violat':164C,417C 'vulner':452C 'web':81C,296C 'web-bas':80C,295C 'window':67B 'www.npmjs.com':181C 'www.npmjs.com/package/dcmjs':180C 'xx5g':14A","nicknames":[],"mitigations":[],"who_affected":"Applications that parse DICOM files with dcmjs in Node.js or the browser, including web viewers and DICOMweb pipelines that build on it. The maintainer rates it low because malformed input yields NaN or Infinity that callers must range-check anyway, and no trust boundary is crossed. Projects that do not parse untrusted DICOM with dcmjs can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T13:29:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-px68-xx5g-48q5","url":"https://github.com/advisories/GHSA-px68-xx5g-48q5","severity":"low","published_at":"2026-10-27T13:29:57+00:00","modified_at":"2026-10-27T13:29:59+00:00","first_seen_at":"2026-10-27T13:31:05+00:00","fetched_at":"2026-10-27T13:31:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}