Read the docs
TI-2022-13173 Aliases CVE-2022-31129GHSA-wc69-rhjr-hc9g

Inefficient Regular Expression Complexity in moment

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 15 fixed, 16 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.05551 92nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Partial moment (moment): 2.29.4moment (npm): 2.29.4+1 more productRed Hat: 26 advisoriesRed Hat: 15 fixed, 16 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
momentmoment2.18.0 to before 2.29.42.29.4Patch availableCNA
—moment (npm)2.18.0 to before 2.29.42.29.4Patch availableGHSA-wc69-rhjr-hc9g
—Moment.js (NuGet)2.18.0 to before 2.29.42.29.4Patch availableGHSA-wc69-rhjr-hc9g
  • moment Vendormoment Affected 2.18.0 to before 2.29.4 Fixed in 2.29.4 Patch available CNA
  • moment (npm) Vendor— Affected 2.18.0 to before 2.29.4 Fixed in 2.29.4 Patch available GHSA-wc69-rhjr-hc9g
  • Moment.js (NuGet) Vendor— Affected 2.18.0 to before 2.29.4 Fixed in 2.29.4 Patch available GHSA-wc69-rhjr-hc9g

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:*2.18.0 to before 2.29.4Vulnerablemoment
cpe:2.3:a:momentjs:moment:*:*:*:*:*:nuget:*:*2.18.0 to before 2.29.4Vulnerablemoment
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*35VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*36VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*37VulnerableFedoraproject
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:momentjs:moment:*:*:*:*:*:node.js:*:* Versions 2.18.0 to before 2.29.4 Vulnerable ·moment
  • cpe:2.3:a:momentjs:moment:*:*:*:*:*:nuget:*:* Versions 2.18.0 to before 2.29.4 Vulnerable ·moment
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · CNA moment (moment) Fixed in 2.29.4
  • Fix · GHSA-wc69-rhjr-hc9g moment (npm) Fixed in 2.29.4 Advisory →
  • Fix · GHSA-wc69-rhjr-hc9g Moment.js (NuGet) Fixed in 2.29.4 Advisory →

Red Hat 26 advisories

  • RHSA-2023:3623 Released 2023-06-15 · Red Hat rating Moderate
    Red Hat Ceph Storage 6.1 security and bug fix update
    • Red Hat Ceph Storage 6.1 Tools ansible-collection-ansible-posix-1.2.0-1.3.el9ost, ceph-2:17.2.6-70.el9cp, ceph-base-2:17.2.6-70.el9cp +26
  • RHSA-2023:1486 Released 2023-03-28 · Red Hat rating Important
    Red Hat Gluster Storage web-admin-build security update
    • Red Hat Gluster 3.5 Web Administration on RHEL-7 grafana-5.2.4-6.el7rhgs, rubygem-puma-4.3.12-1.el7rhgs, rubygem-puma-doc-4.3.12-1.el7rhgs +4
  • RHSA-2023:1043 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el7sso
Show 23 more Red Hat advisories
  • RHSA-2023:1049 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update
    • Red Hat Single Sign-On 7
  • RHSA-2023:1047 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2023:1045 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el9sso
  • RHSA-2023:1044 Released 2023-03-01 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.2 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.6-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.6-1.redhat_00001.1.el8sso
  • RHSA-2022:8652 Released 2022-11-28 · Red Hat rating Important
    Red Hat Fuse 7.11.1 release and security update
    • Red Hat Fuse 7.11.1
  • RHSA-2022:7313 Released 2022-11-02 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.6.2 security update and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
  • RHSA-2022:7276 Released 2022-11-01 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.4.8 security fixes and container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
  • RHSA-2022:7055 Released 2022-10-19 · Red Hat rating Moderate
    RHOSDT 2.6.0 operator/operand containers Security Update
    • Red Hat OpenShift distributed tracing 2.6 rhosdt/opentelemetry-collector-rhel8, rhosdt/opentelemetry-rhel8-operator
  • RHSA-2022:6835 Released 2022-10-06 · Red Hat rating Important
    Service Registry (container images) release and security update [2.3.0.GA]
    • RHINT Service Registry 2.3.0 GA
  • RHSA-2022:6813 Released 2022-10-05 · Red Hat rating Important
    Red Hat Process Automation Manager 7.13.1 security update
    • RHPAM 7.13.1 async
  • RHSA-2022:6696 Released 2022-09-26 · Red Hat rating Critical
    Red Hat Advanced Cluster Management 2.4.6 security update and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
  • RHSA-2022:6507 Released 2022-09-13 · Red Hat rating Critical
    Red Hat Advanced Cluster Management 2.5.2 security fixes and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.5 for RHEL 8 rhacm2/acm-cluster-proxy-rhel8, rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8 +47
  • RHSA-2022:6422 Released 2022-09-12 · Red Hat rating Critical
    Multicluster Engine for Kubernetes 2.0.2 security and bug fixes
    • multicluster engine for Kubernetes 2.0 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +35
  • RHSA-2022:6393 Released 2022-09-08 · Red Hat rating Important
    RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 ovirt-engine-4.5.2.4-0.1.el8ev, ovirt-engine-backend-4.5.2.4-0.1.el8ev, ovirt-engine-dbscripts-4.5.2.4-0.1.el8ev +20
  • RHSA-2022:6392 Released 2022-09-08 · Red Hat rating Important
    RHV RHEL Host (ovirt-host) [ovirt-4.5.2] security update
    • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts cockpit-ovirt-0.16.2-1.el8ev, cockpit-ovirt-dashboard-0.16.2-1.el8ev
  • RHSA-2022:6370 Released 2022-09-06 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.6.0 security updates and bug fixes
    • Red Hat Advanced Cluster Management for Kubernetes 2.6 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8, rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8 +45
  • RHSA-2022:6345 Released 2022-09-06 · Red Hat rating Moderate
    Multicluster Engine for Kubernetes 2.1 security updates and bug fixes
    • multicluster engine for Kubernetes 2.1 for RHEL 8 multicluster-engine/agent-service-rhel8, multicluster-engine/apiserver-network-proxy-rhel8, multicluster-engine/assisted-image-service-rhel8 +37
  • RHSA-2022:6277 Released 2022-08-31 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.1.5 security update
    • OpenShift Service Mesh 2.1 servicemesh-2.1.5-1.el8, servicemesh-cni-2.1.5-1.el8, servicemesh-operator-2.1.5-1.el8 +6
  • RHSA-2022:6272 Released 2022-08-31 · Red Hat rating Moderate
    Red Hat OpenShift Service Mesh 2.0.11 security update
    • OpenShift Service Mesh 2.0 servicemesh-prometheus-2.14.0-18.el8.1
  • RHSA-2022:6156 Released 2022-08-24 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.11.0 security, enhancement, & bugfix update
    • RHODF 4.11 for RHEL 8 odf4/cephcsi-rhel8, odf4/mcg-core-rhel8, odf4/mcg-rhel8-operator +12
  • RHSA-2022:5915 Released 2022-08-08 · Red Hat rating Moderate
    Red Hat Kiali for OpenShift Service Mesh 2.2 security update
    • RHOSSM 2.2 for RHEL 8 openshift-service-mesh/kiali-rhel8
  • RHSA-2022:5914 Released 2022-08-08 · Red Hat rating Moderate
    Red Hat Kiali for OpenShift Service Mesh 2.1 security update
    • OpenShift Service Mesh 2.1 openshift-service-mesh/kiali-rhel8
  • RHSA-2022:5913 Released 2022-08-08 · Red Hat rating Moderate
    Red Hat Kiali for OpenShift Service Mesh 2.0 security update
    • OpenShift Service Mesh 2.0 openshift-service-mesh/kiali-rhel8

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Service Mesh 2.0AffectedNo fix planned: Will not fix
OpenShift Service Mesh 2.1AffectedNo fix planned: Will not fix
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Ceph Storage 3AffectedNo fix planned: Will not fix
Red Hat Ceph Storage 4AffectedNo fix yet: Fix deferred
Red Hat Ceph Storage 5AffectedNo fix yet
Red Hat Data Grid 8AffectedNo fix planned: Will not fix
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Integration Data Virtualisation OperatorAffectedNo fix planned: Out of support scope
Red Hat Integration Service RegistryAffectedNo fix yet
Red Hat JBoss Data Grid 7AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenShift GitOpsAffectedNo fix yet
Red Hat OpenShift distributed tracing 2AffectedNo fix yet
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix planned: Will not fix
Middleware Containers for OpenShiftFixed RHSA-2023:1047
OpenShift Service Mesh 2.0Fixed RHSA-2022:5913, RHSA-2022:6272
OpenShift Service Mesh 2.1Fixed RHSA-2022:5914, RHSA-2022:6277
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2022:6393
RHINT Service Registry 2.3.0 GAFixed RHSA-2022:6835
RHODF 4.11 for RHEL 8Fixed RHSA-2022:6156
RHOSSM 2.2 for RHEL 8Fixed RHSA-2022:5915
RHPAM 7.13.1 asyncFixed RHSA-2022:6813
Red Hat Fuse 7.11.1Fixed RHSA-2022:8652
Red Hat Gluster 3.5 Web Administration on RHEL-7Fixed RHSA-2023:1486
Red Hat Single Sign-On 7Fixed RHSA-2023:1049
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2023:1043
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2023:1044
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2023:1045
Red Hat Virtualization 4 Management Agent for RHEL 7 HostsFixed RHSA-2022:6392
Not affected: 18 products
  • Logging Subsystem for Red Hat OpenShift
  • OpenShift Service Mesh 2.0
  • OpenShift Service Mesh 2.1
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • RHODF 4.11 for RHEL 8
  • RHOSSM 2.2 for RHEL 8
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Gluster 3.5 Web Administration on RHEL-7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Quay 3
  • Red Hat Virtualization 4
  • Red Hat Virtualization 4 Hypervisor for RHEL 8
  • Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31129
  2. 2026-10-03 Alias added: GHSA-wc69-rhjr-hc9g

References

Exploit 2

Patch 1

Advisory 8

Other 15

  • TI-2022-08598 Path Traversal in Moment.js CVSS 3.1HIGH 7.5
  • TI-2016-03445 The duration function in the moment package before 2.11.2 for Node.js allows remote… CVSS 3.1MEDIUM 6.5
  • TI-2017-13399 The moment module before 2.19.3 for Node.js is prone to a regular expression denial of… CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences