The duration function in the moment package before 2.11.2 for Node.js allows remote…
Priority MEDIUM 41CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
Why it matters now
EPSS 0.09905 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial moment (npm): 2.11.2Red Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | moment (npm) | before 2.11.2 | 2.11.2 | Patch available | GHSA-87vv-r9j6-g5qv |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- moment (npm) Vendor— Affected before 2.11.2 Fixed in 2.11.2 Patch available GHSA-87vv-r9j6-g5qv
Remediation
- Fix · GHSA-87vv-r9j6-g5qv moment (npm) Fixed in 2.11.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 5 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2016-4055
- 2026-10-03 Alias added: GHSA-87vv-r9j6-g5qv
References
Patch 2
Advisory 3
Other 10
- [flink-user] 20190811 Apache flink 1.7.2 security issues
- [flink-dev] 20190811 Apache flink 1.7.2 security issues
- [flink-user] 20190813 Apache flink 1.7.2 security issues
- [flink-user] 20190813 Re: Apache flink 1.7.2 security issues
- https://github.com/moment/moment
- https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E
- https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E
- https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E
- https://www.npmjs.com/advisories/55
Sources
- CVE-2016-4055 · CVE Program
- CVE-2016-4055 · NVD
- FIRST EPSS
- GHSA-87vv-r9j6-g5qv · GitHub Advisory Database · CC BY 4.0
- CVE-2016-4055 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences