moment vulnerable to Path Traversal via crafted non-string locale name
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 28 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| moment | moment | 2.29.2 to before 2.31.0 | 2.31.0 | Patch available | CNA |
| — | moment (npm) | 2.29.2 to before 2.31.0 | 2.31.0 | Patch available | GHSA-4p3w-j4w9-5jqw |
- moment Vendormoment Affected 2.29.2 to before 2.31.0 Fixed in 2.31.0 Patch available CNA
- moment (npm) Vendor— Affected 2.29.2 to before 2.31.0 Fixed in 2.31.0 Patch available GHSA-4p3w-j4w9-5jqw
Remediation
- Fix · CNA moment (moment) Fixed in 2.31.0
- Fix · GHSA-4p3w-j4w9-5jqw moment (npm) Fixed in 2.31.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Multicluster Engine for Kubernetes | Affected | No fix planned: Out of support scope |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Out of support scope |
| Red Hat AMQ Broker 7 | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ansible Automation Platform 2 | Affected | No fix planned: Out of support scope |
| Red Hat Build of Podman Desktop | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 4 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Hardened Images | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 8 | Affected | No fix yet: Fix deferred |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift GitOps | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Out of support scope |
| Red Hat Trusted Artifact Signer | Affected | No fix yet: Fix deferred |
| Red Hat build of Apache Camel for Spring Boot 4 | Affected | No fix yet: Fix deferred |
| Red Hat build of Apicurio Registry 3 | Affected | No fix yet: Fix deferred |
Not affected: 3 products
- Red Hat Discovery 2
- Red Hat Enterprise Linux 8
- Red Hat Hardened Images
Timeline
- 2026-10-02 Threatist record created from CVE-2026-17495
- 2026-10-03 Alias added: GHSA-4p3w-j4w9-5jqw
References
Other 6
- https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw
- https://cna.openjsf.org/security-advisories.html
- https://github.com/moment/moment/pull/6386
- https://github.com/moment/moment/commit/5f7d983c9881e65e07574de9dda3190d99520c07
- https://github.com/moment/moment
- https://github.com/moment/moment/releases/tag/2.31.0
More moment vulnerabilities
- TI-2022-13173 Inefficient Regular Expression Complexity in moment CVSS 3.1HIGH 7.5
- TI-2022-08598 Path Traversal in Moment.js CVSS 3.1HIGH 7.5
- TI-2016-03445 The duration function in the moment package before 2.11.2 for Node.js allows remote… CVSS 3.1MEDIUM 6.5
- TI-2017-13399 The moment module before 2.19.3 for Node.js is prone to a regular expression denial of… CVSS 3.1HIGH 7.5
- TI-2023-08716 luxon.js inefficient regular expression complexity vulnerability CVSS 3.1HIGH 7.5
Sources
- CVE-2026-17495 · CVE Program
- CVE-2026-17495 · NVD
- FIRST EPSS
- GHSA-4p3w-j4w9-5jqw · GitHub Advisory Database · CC BY 4.0
- CVE-2026-17495 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences