JavaScript Vulnerability Found in DICOM Manipulation Library by dcmjs

CVE-2026-46350

What is CVE-2026-46350?

The dcmjs library, used for DICOM manipulation, contains a vulnerability in its DecimalString and IntegerString implementations. Prior to version 0.52.0, the library's sanitization of text input using a permissive regular expression can lead to serious mathematical inaccuracies. Specifically, scientifically formatted numbers can result in positive or negative infinity, and improper handling can lead to invalid strings being converted to NaN. Moreover, the IntegerString component allows values that exceed the limits of DICOM's signed 32-bit integer range. This vulnerability allows flawed values to propagate through systems, affecting calculations in spatial geometry, display settings, dose scaling, and other critical processing tasks, ultimately leading to erroneous outcomes.

References