moment vulnerable to Path Traversal via crafted non-string locale name
Impact
moment before 2.31.0 is vulnerable to path traversal in moment.locale(). When an application passes a non-string, attacker-influenced value to moment.locale(), a specially crafted object can bypass the locale name validation and cause moment to load a file from an attacker-controlled path. This is a further bypass of the validation added in 2.29.2 for CVE-2022-24785.
This affects server-side (npm) users only. Plain string input is not affected: the existing validation correctly rejects strings that contain path separators.
Patches
This issue is patched in moment 2.31.0.
Workarounds
Validate that any user-supplied input is a string before passing it to moment.locale().
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | moment | >= 2.29.2, < 2.31.0 | 2.31.0 |
References
- https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw
- https://nvd.nist.gov/vuln/detail/CVE-2026-17495
- https://github.com/moment/moment/pull/6386
- https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07
- https://cna.openjsf.org/security-advisories.html
- https://github.com/moment/moment
- https://github.com/moment/moment/releases/tag/2.31.0
- CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N- Weakness (CWE)
CWE-27- Platform
- npm
- Package
moment- Disclosed
- 29.09.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-4p3w-j4w9-5jqw - CC BY 4.0
Vulnerability history: moment
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 10.2017 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 3
- Medium 2
Disclosures per year
- 2017: 1
- 2018: 1
- 2019: 0
- 2020: 0
- 2021: 0
- 2022: 2
- 2023: 0
- 2024: 0
- 2025: 0
- 2026: 1
-
moment vulnerable to Path Traversal via crafted non-string locale name this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.