Skip to content
OpenAdvisories

Package · Debian

node-moment

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-17495

    moment vulnerable to Path Traversal via crafted non-string locale name

    moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assu…

    moment moment node-moment moment Debian Ubuntu npm
  • Medium 6.5
    CVE-2016-4055

    Regular Expression Denial of Service in moment

    The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

    node-moment moment node-moment Debian Ubuntu npm