CVE-2026-46350

dcmjs is a JavaScript implementation of DICOM manipulation. Prior to 0.52.0, the DecimalString and IntegerString implementations in src/ValueRepresentation.js sanitize text with a permissive regular expression and pass the result to JavaScript's Number constructor without validating finiteness or the DICOM value-representation rules. Scientific notation overflow in a DS or IS field can produce positive or negative Infinity, while stripping alphabetic characters from signed infinity text can leave a sign-only string that converts to NaN. IntegerString also accepts exponent notation and values outside the DICOM signed 32-bit IS range. Applications that trust these parsed values can propagate invalid numbers into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. This issue is fixed in version 0.52.0.

• CWE-20
• CWE-1284

• https://github.com/dcmjs-org/dcmjs/commit/81e7e11cdefb56aa1a65bfe259648b865583ff88
• https://github.com/dcmjs-org/dcmjs/pull/497
• https://github.com/dcmjs-org/dcmjs/releases/tag/v0.52.0
• https://github.com/dcmjs-org/dcmjs/security/advisories/GHSA-px68-xx5g-48q5

Published

Nov 5, 2026

Last Modified

Nov 5, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-46345compliance-trestle is a tooling platform for managing compli…8.4
• CVE-2026-46346The Goobi viewer is a web application that allows digitised …6.5
• CVE-2026-46347The Goobi viewer is a web application that allows digitised …6.8
• CVE-2026-46348Mastodon is a free, open-source social network server based …8.7
• CVE-2026-46349Mastodon is a free, open-source social network server based …5.3
• CVE-2026-4635Mattermost versions 11.6.x <= 11.6.0, 11.5.x <= 11.5.3, 11.4…5.3
• CVE-2026-46351BigBlueButton is an open-source virtual classroom. Prior to …8.1
• CVE-2026-46352Suricata is a network Intrusion Detection System, Intrusion …7.5
• CVE-2026-46353BigBlueButton is an open-source virtual classroom. Prior to …8.1
• CVE-2026-46354Coder allows organizations to provision remote development e…9.1
• CVE-2026-46355BigBlueButton is an open-source virtual classroom. Prior to …7.1
• CVE-2026-46356Fleet is open source device management software. Prior to ve…7.5