Description
The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-moment | 2.13.0+ds-1 | — |
| Debian 13 | node-moment | 2.13.0+ds-1 | — |
| Debian 12 | node-moment | 2.13.0+ds-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | node-moment | 2.11.0+ds-1ubuntu0.1~esm1 | USN-4786-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | moment | < 2.11.2 | 2.11.2 | GHSA-87vv-r9j6-g5qv |
Advisories 1
- USN-4786-1 node-moment vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
References
- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
- https://nodesecurity.io/advisories/55
- [oss-security] 20160420 various vulnerabilities in Node.js packages mailing-list
- 95849 vdb-entry
- https://www.tenable.com/security/tns-2019-02
- [flink-user] 20190811 Apache flink 1.7.2 security issues mailing-list
- [flink-dev] 20190811 Apache flink 1.7.2 security issues mailing-list
- [flink-user] 20190813 Apache flink 1.7.2 security issues mailing-list
- [flink-user] 20190813 Re: Apache flink 1.7.2 security issues mailing-list