Read the docs
TI-2017-13399 Aliases CVE-2017-18214GHSA-446m-mv8f-q348

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of…

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 fixed, 2 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.

Why it matters now

EPSS 0.03649 89th percentileScored 2026-11-07
Fix Partial moment (npm): 2.19.3Red Hat: 4 advisoriesRed Hat: 4 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—moment (npm)before 2.19.32.19.3Patch availableGHSA-446m-mv8f-q348
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • moment (npm) Vendor— Affected before 2.19.3 Fixed in 2.19.3 Patch available GHSA-446m-mv8f-q348

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:*up to 2.19.2Vulnerablemoment
cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*up to 8.2.3VulnerableTenable
  • cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:* Versions up to 2.19.2 Vulnerable ·moment
  • cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:* Versions up to 8.2.3 Vulnerable ·Tenable

Remediation

  • Fix · GHSA-446m-mv8f-q348 moment (npm) Fixed in 2.19.3 Advisory →

Red Hat 4 advisories

  • RHSA-2023:0556 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
  • RHSA-2023:0554 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
  • RHSA-2023:0552 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
Show 1 more Red Hat advisories
  • RHSA-2023:0553 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Mobile Application Platform 4AffectedNo fix yet
Red Hat Satellite 5AffectedNo fix planned: Will not fix
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.4.9Fixed RHSA-2023:0556
Not affected: 5 products
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.9
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-18214
  2. 2026-10-03 Alias added: GHSA-446m-mv8f-q348

References

Patch 1

Advisory 3

Other 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences