Description
Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into moment.duration().
Recommendation
Update the moment package to the latest compatible version. Followings are version details:
- Affected version(s): < 2.11.2
- Patched version(s): 2.11.2
References
- GHSA-87vv-r9j6-g5qv
- www.npmjs.com
- lists.apache.org
- www.tenable.com
- www.openwall.com
- www.oracle.com
- www.securityfocus.com
- CVE-2016-4055
- CWE-400
- CAPEC-310
- OWASP 2021-A6
Related Issues
- Regular Expression Denial of Service in hawk - CVE-2016-2515
- Regular Expression Denial of Service in moment - CVE-2017-18214
- Regular Expression Denial of Service in jadedown - CVE-2016-10520
- Regular Expression Denial of Service in riot-compiler - CVE-2016-10527
You might also like:
- Tags:
- npm
- moment
Anything's wrong? Let us know Last updated on February 03, 2023