dcmjs-org vulnerabilities and threats

CVE-2026-46350 is a critical vulnerability in dcmjs versions prior to 0.52.0 involving improper input validation in the DecimalString and IntegerString implementations. These components sanitize input permissively and convert it to JavaScript numbers without validating finiteness or adherence to DICOM value-representation rules. This can lead to parsing of invalid numeric values such as positive or negative Infinity or NaN, which may propagate into spatial geometry, display windowing, dose scaling, frame counts, rescaling, or volume reconstruction, causing incorrect calculations or disrupted processing. The issue is fixed in dcmjs version 0.52.0.