JSONata is a JSON query and transformation language. Prior to 2.2.0 and 1.8.9, malicious non‑matching inputs to the $toMillis function can cause superlinear backtracking in the ISO‑8601 validation regex, leading to denial of service in applications that evaluate user‑provided JSONata expressions. This issue is fixed in version 2.2.0 and 1.8.9. The underlying weakness is a regular‑expression backtracking flaw (CWE‑1333). No code execution or data disclosure occurs, but an attacker can interrupt service availability by sending crafted expressions.

The vulnerable component is the JSONata query language (jsonata-js:jsonata). Versions prior to 2.2.0 are affected; upgrading to v2.2.0 or later removes the problematic regex. All users of JSONata in that version range should update or otherwise restrict the use of $toMillis.

The CVSS score of 7.5 ranks this as a high‑severity vulnerability. An EPSS score of less than 1% indicates a low likelihood of exploitation at the time of analysis, and it is not listed in the CISA KEV catalog. The attack vector is likely to be an application that accepts arbitrary JSONata expressions from users, such that an attacker can supply a crafted expression that triggers the backtracking. While the probability of use is low, the impact on availability warrants prompt action.