Regular Expression Denial of Service in moment (GHSA-87vv-r9j6-g5qv)

Description

Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into moment.duration().

Recommendation

Update the moment package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.11.2
• Patched version(s): 2.11.2

References

• GHSA-87vv-r9j6-g5qv
• www.npmjs.com
• lists.apache.org
• www.tenable.com
• www.openwall.com
• www.oracle.com
• www.securityfocus.com
• CVE-2016-4055
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Moment.js vulnerable to Inefficient Regular Expression Complexity - CVE-2022-31129
• Finance.js vulnerable to DoS via the IRR function’s depth parameter - CVE-2025-56571
• MetaMask SDK indirectly exposed via malicious [email protected] dependency - Vulnerability
• Mermaid improperly sanitizes sequence diagram labels leading to XSS - CVE-2025-54881

Tags:

npm

moment