Skip to content
OpenAdvisories
High USN-4786-1 2 CVEs

node-moment vulnerabilities

Published Mar 15, 2021 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Moment.js mishandled certain regular expressions. An
attacker could use this vulnerability to cause a denial of service.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS node-moment 2.11.0+ds-1ubuntu0.1~esm1

Vulnerabilities 2

  • High 7.5
    CVE-2017-18214

    Regular Expression Denial of Service in moment

    The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.

    reaper ntopng moment node-moment Debian Ubuntu Azure Linux npm
  • Medium 6.5
    CVE-2016-4055

    Regular Expression Denial of Service in moment

    The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

    node-moment moment node-moment Debian Ubuntu npm

References

  • report
    https://ubuntu.com/security/CVE-2016-4055
  • report
    https://ubuntu.com/security/CVE-2017-18214