Description
This vulnerability impacts npm (server) users of moment.js, especially if user provided locale string, eg fr is directly used to switch moment locale.
Recommendation
Update the moment package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.29.2
- Patched version(s): 2.29.2
References
- GHSA-8hfj-j24r-96c4
- www.tenable.com
- lists.debian.org
- lists.fedoraproject.org
- security.netapp.com
- CVE-2022-24785
- CWE-22
- CWE-27
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
Related Issues
- electerm has Path Traversal in Zmodem and Trzsz Download Filename Handling - CVE-2026-49253
- JSZip contains Path Traversal via loadAsync - CVE-2022-48285
- Agnai vulnerable to Relative Path Traversal in Image Upload - CVE-2024-47171
- IPX Allows Path Traversal via Prefix Matching Bypass - CVE-2025-54387
You might also like:
- Tags:
- npm
- moment
Anything's wrong? Let us know Last updated on November 04, 2025