Description
moment before 2.31.0 is vulnerable to path traversal in moment.locale(). When an application passes a non-string, attacker-influenced value to moment.locale(), a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. This is a further bypass of the validation added in 2.
Recommendation
Update the moment package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.29.2, < 2.31.0
- Patched version(s): 2.31.0
References
Could your website be exposed too?
SmartScanner can check your website for moment vulnerable to Path Traversal via crafted non-string locale name and gives you actionable findings to investigate.
Start a free scanRelated Issues
- webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath - CVE-2026-76844
- fast-uri vulnerable to path traversal via percent-encoded dot segments - CVE-2026-6321
- dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform() - CVE-2026-27837
- Kysely has a MySQL SQL Injection via Backslash Escape Bypass in non-type-safe usage of JSON path keys. - CVE-2026-33442
You might also like:
See something that needs correcting? Let us knowUpdated September 29, 2026