Description
Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into moment.duration().
Recommendation
Update the moment package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.11.2
- Patched version(s): 2.11.2
References
- GHSA-87vv-r9j6-g5qv
- www.npmjs.com
- lists.apache.org
- www.tenable.com
- www.openwall.com
- www.oracle.com
- www.securityfocus.com
- CVE-2016-4055
- CWE-400
- CAPEC-310
- OWASP 2021-A6
Related Issues
- Regular Expression Denial of Service in jadedown - CVE-2016-10520
- Regular Expression Denial of Service in moment - CVE-2017-18214
- uap-core Regular Expression Denial of Service issue - CVE-2018-20164
- Signal K Server has an Unauthenticated Regular Expression Denial of Service (ReDoS) via WebSocket Subscription Paths - CVE-2026-39320
You might also like:
- Tags:
- npm
- moment
Anything's wrong? Let us know Last updated on February 03, 2023