CVE-2026-46350

CVE-2026-46350 is a low-severity improper input validation vulnerability in dcmjs (npm), affecting versions < 0.52.0. It is fixed in 0.52.0.

Does this CVE actually affect you?

Kodem shows which CVEs are reachable and running in your applications, so you fix what's exploitable, not just what's listed.

Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.

Runtime intelligence, not another scanner.

Summary

dcmjs: DS/IS VALUE REPRESENTATION INPUT VALIDATION BYPASS

dcmjs, a JavaScript library for DICOM manipulation used in web-based medical
imaging viewers, contains an input validation bypass in its handling of DS
(Decimal String) and IS (Integer String) value representations.

The DecimalString and IntegerString classes in ValueRepresentation.js use a
regex sanitizer followed by JavaScript's Number() constructor. While the regex
strips direct NaN/Infinity strings, it preserves scientific notation (including
the 'e' character), enabling:

  1. Infinity injection via scientific notation overflow (1e999999)
  2. NaN injection via sign-only remnants from stripped inf strings ("-inf" -> "-")
  3. IS accepting scientific notation in violation of PS3.5
AFFECTED PRODUCT

Product: dcmjs (JavaScript DICOM manipulation library)
Repository: https://github.com/dcmjs-org/dcmjs
npm: https://www.npmjs.com/package/dcmjs
Affected Versions: < 0.52.0 (patched in 0.52.0, released 2026-05-19)
CVE: CVE-2026-46350 (assigned by GitHub 2026-05-13)
CWE: CWE-20 (Improper Input Validation)
CVSS Score: 7.5 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Maintainer note: The CVSS score above is the reporter's assessment; dcmjs rates this low, because malformed input produces NaN/Infinity in values the caller must range-check in any case (both are reachable by other means, and no trust boundary enforced by dcmjs is crossed).

DOWNSTREAM IMPACT

dcmjs is a foundational library used by:

  • OHIF Viewer (Open Health Imaging Foundation)
  • Cornerstone.js ecosystem
  • DICOMweb client/server implementations
  • Research and clinical web-based PACS viewers
  • Any Node.js or browser application parsing DICOM via dcmjs
ROOT CAUSE

In src/ValueRepresentation.js, both DecimalString and IntegerString use:

let returnVal = numberStr.trim().replace(/[^0-9.\\\-+e]/gi, "");
return returnVal === "" ? null : Number(returnVal);

The regex /[^0-9.\-+e]/gi strips characters NOT in the set {0-9, ., , -, +,
e, E}. This provides partial defense: direct "NaN" and "Infinity" strings are
stripped to empty/null. However:

(a) Scientific notation is fully preserved because 'e', digits, '+', '-', '.'
all pass the regex. "1e999999" passes intact, and Number("1e999999")
returns JavaScript Infinity.

(b) The string "-inf" is stripped to just "-" (only the minus passes the
regex). Number("-") returns JavaScript NaN.

(c) IntegerString uses the SAME regex/logic as DecimalString, meaning IS
accepts scientific notation ("1e5" -> 100000) in violation of PS3.5
Section 6.2, which restricts IS to characters 0-9, +, -.

(d) No range validation exists for IS values (PS3.5 requires [-2^31, 2^31-1])
or DS values (16-character max, fixed/floating-point only).

VULNERABILITY DETAILS

Attack Vector 1: Infinity via Scientific Notation Overflow

Input: DS or IS field containing "1e999999"
Regex: Passes (all chars in allowed set)
Result: Number("1e999999") -> Infinity
Impact: Infinity propagates through all downstream arithmetic

Attack Vector 2: Negative Infinity via Scientific Notation

Input: DS or IS field containing "-1e999999"
Regex: Passes
Result: Number("-1e999999") -> -Infinity
Impact: Negative Infinity in spatial/dosimetric calculations

Attack Vector 3: NaN via Sign-Only Remnant

Input: DS or IS field containing "-inf"
Regex: Strips to "-"
Result: Number("-") -> NaN
Impact: NaN propagates silently through arithmetic (IEEE 754)

Attack Vector 4: NaN via Plus-Only Remnant

Input: DS or IS field containing "+inf"
Regex: Strips to "+"
Result: Number("+") -> NaN
Impact: Same as above

Attack Vector 5: IS Scientific Notation Bypass

Input: IS field containing "1e5"
Regex: Passes
Result: Number("1e5") -> 100000
Impact: Integer fields accept non-integer representation, violating PS3.5

Attack Vector 6: IS Extreme Overflow

Input: IS field containing "1e18"
Regex: Passes
Result: Number("1e18") -> 1000000000000000000
Impact: Far exceeds IS range [-2^31, 2^31-1], no bounds check

CLINICAL IMPACT

dcmjs is used in web-based DICOM viewers and processing pipelines.
Corrupted values affect:

  • PixelSpacing / ImagePositionPatient: Spatial geometry corruption prevents
    accurate measurement and registration in web viewers

  • WindowCenter / WindowWidth: Display pipeline corruption makes images
    unreadable (all black or all white)

  • DoseGridScaling / NumberOfFrames: Radiation therapy dose display errors
    and denial of service via frame count overflow

  • RescaleSlope / RescaleIntercept: Hounsfield unit conversion produces
    invalid values, corrupting quantitative analysis

  • SliceThickness: Volume reconstruction fails in multiplanar reformats

Impact

The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.

Affected versions

dcmjs (< 0.52.0)

Security releases

dcmjs → 0.52.0 (npm)

Kodem intelligence

Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.

Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.

Already deployed Kodem?

See it in your environmentNew to Kodem? Get a demo →

Remediation advice

Upgrade dcmjs to 0.52.0 or later to resolve this vulnerability.

Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.

Frequently Asked Questions

  1. What is CVE-2026-46350? CVE-2026-46350 is a low-severity improper input validation vulnerability in dcmjs (npm), affecting versions < 0.52.0. It is fixed in 0.52.0. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
  2. Which versions of dcmjs are affected by CVE-2026-46350? dcmjs (npm) versions < 0.52.0 is affected.
  3. Is there a fix for CVE-2026-46350? Yes. CVE-2026-46350 is fixed in 0.52.0. Upgrade to this version or later.
  4. Is CVE-2026-46350 exploitable, and should I be worried? Whether CVE-2026-46350 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
  5. What actually determines whether CVE-2026-46350 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
  6. How do I fix CVE-2026-46350? Upgrade dcmjs to 0.52.0 or later.

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo