### Author:  [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [4 September 2026 10:51 UTC](https://discourse.nodered.org/t/problems-with-jsonata-in-node-red/101734/1 "2026-09-04T10:51:49Z")
Hi,
We shipped new maintenance releases of Node-RED earlier this week to update the JSONata dependency that has a critical CVE published against it.
Unfortunately, we have since discovered the fix for the CVE is now blocking behaviour we had relied on.
JSONata can no longer access properties on objects that are in the prototype chain, or defined via getter/setter properties. That's fine if you are dealing purely with JSON data (which is JSONata's focus) - but it is problematic when dealing with more general JavaScript objects.
Here are two examples that no longer work:
```auto
const url = new URL("https://example.com")
// Get `url.hostname`
console.log(await jsonata("hostname").evaluate(url))
// Old JSONata -> 'example.com'
// Latest JSONata -> undefined
```
More specifically, in Node-RED, we extend JSONata with the `$moment()` function. Previously, the expression `$moment().hour()` could be used to get the current hour of the day.
That no longer works in Node-RED 5.0.6.
There is an open issue against JSONata regarding this change in behaviour that was introduced - but it has gone unanswered for some time.
As it stands, we are stuck between a rock and a hardplace. With the JSONata CVE flagged as critical, it was blocking Node-RED from being used for some organisations due to security policies. The fix breaks behaviour we rely on.
Normally we'd just do the work to fix these things. But as it stands, I don't have a solution to this problem, so wanted to acknowledge it here.
An issue has been raised against 5.0.6 that covers it. If we're able to find a non-breaking way forward, we'll keep that issue updated.
>
>
> \### Current Behavior
>
> Seems like the JSONata update (probably the JSONata surrou…nding code in a11abad3d721a7bf89c42a96aab9a3bcec1626a7) has caused regression in $moment().
>
> This affects 5.0.5 and 5.0.6 Node-RED version.
> Version 5.0.4 behaves correctly.
>
> \### Expected Behavior
>
> \`$moment().hour()\` should produce an integer, but now throws an error:
>
> \`Invalid JSONata expression: Attempted to invoke a non-function.\`
>
> \### Environment
>
> \- Node-RED version: 5.0.5 and 5.0.4
> \- Node.js version: 24.20.0
> \- npm version: 11.19.0
> \- Platform/OS: Raspberry Pi OS Bookworm
---
### Author:  [@gerry](https://discourse.nodered.org/u/gerry)
#### Post date: [4 September 2026 12:32 UTC](https://discourse.nodered.org/t/problems-with-jsonata-in-node-red/101734/2 "2026-09-04T12:32:40Z")
So there was an issue in 5.0.5 so 5.0.6 was released but it has another problem. Is the recommended plan as of right now to stay on 5.0.4?
---
### Author:  [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [4 September 2026 13:06 UTC](https://discourse.nodered.org/t/problems-with-jsonata-in-node-red/101734/3 "2026-09-04T13:06:36Z")
@gerry
- 5.0.4 includes the older JSONata version with a critical CVE warning. As long as you aren't importing random flows from the internet, or letting strangers deploy flows, the CVE is not a risk for you.
- 5.0.5 updated JSONata and some other dependencies as routine maintenance. One of the other dependencies turned out to be broken on Pi 4s.
- 5.0.6 reverted that broken dependency - but at that time, we weren't aware of these new issues with JSONata
If you aren't using JSONata expressions in your flows, or only for basic things, then 5.0.6 is fine for you.
One option we do have is to ship 5.0.7 (and 4.1.15) with a reverted JSONata. But we know that will then block some users from installing due to the critical CVE that gets included.
Essentially, there is currently no good and obvious solution that doesn't break something for someone. Welcome to my Friday.
---
### Author:  [@krambriw](https://discourse.nodered.org/u/krambriw)
#### Post date: [5 September 2026 06:21 UTC](https://discourse.nodered.org/t/problems-with-jsonata-in-node-red/101734/4 "2026-09-05T06:21:20Z")
Sorry for any ruined Fridays... đŸ˜‡
Does this (typical usage I use) imply that the following will not work? As example, in a change node:
- access and changing properties of incoming messages?
- access data in context (flow/global)?
- setting or creating a new message property and using it in a later step?
- setting a context variable and using it in a later step?
Examples as below
---
### Author:  [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [8 September 2026 08:50 UTC](https://discourse.nodered.org/t/problems-with-jsonata-in-node-red/101734/5 "2026-09-08T08:50:33Z")
@krambriw I think those expressions are fine.
---
### Author:  [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [8 September 2026 08:55 UTC](https://discourse.nodered.org/t/problems-with-jsonata-in-node-red/101734/6 "2026-09-08T08:55:34Z")
I had hoped that some magic solution would present itself over the weekend, it hasn't. Whilst discussion of other scripting language choices is good to have, we still need to address the immediate problem users are hitting.
Here is what we're going to do.
I am going to fork JSONata and apply a fix for the issue we're hitting and bundle that fork in Node-RED. This is hopefully a temporary measure but allows us to move forward - without the security CVE of older versions and without the changed behaviour of newer versions.
Maintaining a fork isn't certainly not my preferred choice, but given the lack of response from the JSONata maintainers there's not much else we can do. The goal will be to make the absolutely minimal set of changes so that we don't end up diverging too far.
Ideally the fork will be short-lived and we'll be able to shift back at some point in the future.
---
### Author:  [@krambriw](https://discourse.nodered.org/u/krambriw)
#### Post date: [8 September 2026 11:23 UTC](https://discourse.nodered.org/t/problems-with-jsonata-in-node-red/101734/7 "2026-09-08T11:23:14Z")
Thank you very much!!
---
### Author:  [@knolleary](https://discourse.nodered.org/u/knolleary)
#### Post date: [8 September 2026 13:55 UTC](https://discourse.nodered.org/t/problems-with-jsonata-in-node-red/101734/8 "2026-09-08T13:55:38Z")
Node-RED 5.0.7 has been published with the updated JSONata.
Docker images still building - will be ready within the hour.
---
### Author:  [@system](https://discourse.nodered.org/u/system)
#### Post date: [22 September 2026 13:56 UTC](https://discourse.nodered.org/t/problems-with-jsonata-in-node-red/101734/9 "2026-09-22T13:56:08Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.