Read the docs
TI-2022-08598 Aliases CVE-2022-24785GHSA-8hfj-j24r-96c4

Path Traversal in Moment.js

Priority MEDIUM 54CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Partial Red Hat: 20 fixed, 22 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.1384 96th percentileScored 2026-11-07
Fix Partial moment (moment): 2.29.2moment (npm): 2.29.2+1 more productRed Hat: 23 advisoriesRed Hat: 20 fixed, 22 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
momentmoment1.0.1 to before 2.29.22.29.2Patch availableCNA
—moment (npm)before 2.29.22.29.2Patch availableGHSA-8hfj-j24r-96c4
—Moment.js (NuGet)before 2.29.22.29.2Patch availableGHSA-8hfj-j24r-96c4
  • moment Vendormoment Affected 1.0.1 to before 2.29.2 Fixed in 2.29.2 Patch available CNA
  • moment (npm) Vendor— Affected before 2.29.2 Fixed in 2.29.2 Patch available GHSA-8hfj-j24r-96c4
  • Moment.js (NuGet) Vendor— Affected before 2.29.2 Fixed in 2.29.2 Patch available GHSA-8hfj-j24r-96c4

CPE configurations NVD · 7

CPEVersionsRoleVendor
cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:*1.0.1 to before 2.29.2Vulnerablemoment
cpe:2.3:a:momentjs:moment:*:*:*:*:*:nuget:*:*1.0.1 to before 2.29.2Vulnerablemoment
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*before 5.21.0VulnerableTenable
cpe:2.3:a:netapp:active_iq:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:* Versions 1.0.1 to before 2.29.2 Vulnerable ·moment
  • cpe:2.3:a:momentjs:moment:*:*:*:*:*:nuget:*:* Versions 1.0.1 to before 2.29.2 Vulnerable ·moment
  • cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* Versions before 5.21.0 Vulnerable ·Tenable
  • cpe:2.3:a:netapp:active_iq:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA moment (moment) Fixed in 2.29.2
  • Fix · GHSA-8hfj-j24r-96c4 moment (npm) Fixed in 2.29.2 Advisory →
  • Fix · GHSA-8hfj-j24r-96c4 Moment.js (NuGet) Fixed in 2.29.2 Advisory →

Red Hat 23 advisories

  • RHSA-2025:4437 Released 2025-05-05 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.3.13 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-activemq-artemis-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-cli-2.9.0-10.redhat_00021.1.el7eap, eap7-activemq-artemis-commons-2.9.0-10.redhat_00021.1.el7eap +44
  • RHSA-2025:4226 Released 2025-04-28 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.1.10 on RHEL 7 security update
    • Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 Server eap7-activemq-artemis-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-cli-1.5.5.016-1.redhat_00001.1.ep7.el7, eap7-activemq-artemis-commons-1.5.5.016-1.redhat_00001.1.ep7.el7 +22
  • RHSA-2023:3954 Released 2023-06-29 · Red Hat rating Critical
    Red Hat Fuse 7.12 release and security update
    • Red Hat Fuse 7.12
Show 20 more Red Hat advisories
  • RHSA-2023:3642 Released 2023-06-15 · Red Hat rating Important
    Red Hat Ceph Storage 6.1 Container security and bug fix update
    • Red Hat Ceph Storage 6.1 Tools rhceph/keepalived-rhel9, rhceph/rhceph-6-dashboard-rhel9, rhceph/rhceph-6-rhel9 +3
  • RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
  • RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
  • RHSA-2023:0076 Released 2023-01-11 · Red Hat rating Moderate
    Red Hat Ceph Storage 5.3 security update and Bug Fix
    • Red Hat Ceph Storage 5.3 MON ceph-2:16.2.10-94.el8cp, ceph-base-2:16.2.10-94.el8cp, ceph-common-2:16.2.10-94.el8cp +30
    • Red Hat Ceph Storage 5.3 OSD ceph-2:16.2.10-94.el8cp, ceph-base-2:16.2.10-94.el8cp, ceph-common-2:16.2.10-94.el8cp +20
    • Red Hat Ceph Storage 5.3 Tools ceph-2:16.2.10-94.el8cp, ceph-2:16.2.10-94.el9cp, ceph-base-2:16.2.10-94.el8cp +47
  • RHSA-2022:8652 Released 2022-11-28 · Red Hat rating Important
    Red Hat Fuse 7.11.1 release and security update
    • Red Hat Fuse 7.11.1
  • RHSA-2022:7055 Released 2022-10-19 · Red Hat rating Moderate
    RHOSDT 2.6.0 operator/operand containers Security Update
    • Red Hat OpenShift distributed tracing 2.6 rhosdt/opentelemetry-collector-rhel8, rhosdt/opentelemetry-rhel8-operator
  • RHSA-2022:6813 Released 2022-10-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.1 security update
    • RHPAM 7.13.1 async
  • RHSA-2022:6277 Released 2022-08-31 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.1.5 security update
    • OpenShift Service Mesh 2.1 servicemesh-2.1.5-1.el8, servicemesh-cni-2.1.5-1.el8, servicemesh-operator-2.1.5-1.el8 +6
  • RHSA-2022:6272 Released 2022-08-31 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.0.11 security update
    • OpenShift Service Mesh 2.0 servicemesh-prometheus-2.14.0-18.el8.1
  • RHSA-2022:6156 Released 2022-08-24 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
    • RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
  • RHSA-2022:5201 Released 2022-06-27 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.4.5 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
  • RHSA-2022:5006 Released 2022-06-13 · Red Hat rating Important
    Red Hat OpenShift Service Mesh 2.1.3 Containers security update
    • OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8
  • RHSA-2022:4956 Released 2022-06-09 · Red Hat rating Important
    Red Hat Advanced Cluster Management 2.5 security updates, images, and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
  • RHSA-2022:4919 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el8eap +47
  • RHSA-2022:4918 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el7eap +47
  • RHSA-2022:4922 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update
    • Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-databind-2.12.6.1-redhat-00003.jar, com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-4.1.72.Final-redhat-00001.jar +8
  • RHSA-2022:1681 Released 2022-05-03 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix yet
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat 3scale API Management Platform 2AffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Out of support scope
Red Hat Ceph Storage 4AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix yet: Fix deferred
Red Hat Integration Data Virtualisation OperatorAffectedNo fix planned: Out of support scope
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat Openshift Container Storage 4AffectedNo fix planned: Out of support scope
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat Virtualization 4AffectedNo fix planned: Out of support scope
Red Hat build of Apicurio Registry 2AffectedNo fix yet
Middleware Containers for OpenShiftFixed RHSA-2023:1047
OpenShift Service Mesh 2.0Fixed RHSA-2022:6272
OpenShift Service Mesh 2.1Fixed RHSA-2022:5006, RHSA-2022:6277
RHODF 4.11 for RHEL 8Fixed RHSA-2022:6156
RHPAM 7.13.1 asyncFixed RHSA-2022:6813
Red Hat Ceph Storage 5.3 MONFixed RHSA-2023:0076
Red Hat Ceph Storage 5.3 OSDFixed RHSA-2023:0076
Red Hat Ceph Storage 5.3 ToolsFixed RHSA-2023:0076
Red Hat Ceph Storage 6.1 ToolsFixed RHSA-2023:3642
Red Hat Fuse 7.11.1Fixed RHSA-2022:8652
Red Hat Fuse 7.12Fixed RHSA-2023:3954
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2022:4918
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2022:4919
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2022:4922
Red Hat JBoss Enterprise Application Platform 7.1 EUS for RHEL 7 ServerFixed RHSA-2025:4226
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:4437
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:1045
Not affected: 17 products
  • OpenShift Service Mesh 2.0
  • OpenShift Service Mesh 2.1
  • RHODF 4.11 for RHEL 8
  • Red Hat Ceph Storage 5.3 MON
  • Red Hat Ceph Storage 5.3 Tools
  • Red Hat Ceph Storage 6.1 Tools
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Quay 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-24785
  2. 2026-10-03 Alias added: GHSA-8hfj-j24r-96c4

References

Patch 2

Advisory 6

Other 7

  • TI-2022-13173 Inefficient Regular Expression Complexity in moment CVSS 3.1HIGH 7.5
  • TI-2016-03445 The duration function in the moment package before 2.11.2 for Node.js allows remote… CVSS 3.1MEDIUM 6.5
  • TI-2017-13399 The moment module before 2.19.3 for Node.js is prone to a regular expression denial of… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences