Description
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| moment | moment | >= 2.18.0, < 2.29.4 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-moment | 2.29.4+ds-1 | — |
| Debian 13 | node-moment | 2.29.4+ds-1 | — |
| Debian 12 | node-moment | 2.29.4+ds-1 | — |
| Debian 10 | node-moment | 2.24.0+ds-1+deb10u1 | DLA-3295-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | odoo +6 | No fix yet | — |
| Ubuntu 26.04 LTS | odoo +5 | No fix yet | — |
| Ubuntu 25.10 | odoo +8 | No fix yet | — |
| Ubuntu 24.04 LTS | odoo +6 | No fix yet | — |
| Ubuntu 22.04 LTS | node-moment | 2.29.1+ds-3ubuntu0.2 | USN-5559-1 |
| Ubuntu 22.04 LTS | odoo +6 | No fix yet | — |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | node-moment | 2.24.0+ds-2ubuntu0.1 | USN-5559-1 |
| Ubuntu 20.04 LTS | ntopng +6 | No fix yet | — |
| Ubuntu 18.04 LTS | gnucash +4 | No fix yet | — |
| Ubuntu 18.04 LTS | node-moment | 2.20.1+ds-1ubuntu0.1 | USN-5559-1 |
| Ubuntu 16.04 LTS | gnucash +2 | No fix yet | — |
| Ubuntu Pro 26.04 LTS | syncthing | No fix yet | — |
| Ubuntu Pro 24.04 LTS | mediawiki +2 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | mediawiki +1 | No fix yet | — |
| Ubuntu Pro 22.04 LTS | postfixadmin | 3.3.10-2ubuntu0.1~esm1 | USN-6550-1 |
| Ubuntu Pro 20.04 LTS | mediawiki | No fix yet | — |
| Ubuntu Pro 20.04 LTS | postfixadmin | 3.2.1-3ubuntu0.1~esm1 | USN-6550-1 |
| Ubuntu Pro 18.04 LTS | ntopng | No fix yet | — |
| Ubuntu Pro 18.04 LTS | postfixadmin | 3.0.2-2ubuntu0.1~esm1 | USN-6550-1 |
| Ubuntu Pro 16.04 LTS | ntopng +1 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Service Mesh 2 | servicemesh +7 | 2.1.5-1.el8 | RHSA-2022:6277 |
| Red Hat Service Mesh 2 | servicemesh-prometheus | 2.14.0-18.el8.1 | RHSA-2022:6277, RHSA-2022:6272 |
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.3.5-1.el8ev | RHSA-2022:6393 |
| Red Hat Rhev Manager 4 | ovirt-log-collector | 4.4.7-2.el8ev | RHSA-2022:6393 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.9.1-1.el8ev | RHSA-2022:6393 |
| Red Hat Rhev Manager 4 | rhvm +19 | 4.5.2.4-0.1.el8ev | RHSA-2022:6393 |
| Red Hat Rhev Hypervisor 4 | cockpit-ovirt +1 | 0.16.2-1.el8ev | RHSA-2022:6392 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Single Sign On 7 | rh-sso7-keycloak +1 | 18.0.6-1.redhat_00001.1.el7sso | RHSA-2023:1045, RHSA-2023:1044, RHSA-2023:1043 |
| Red Hat Gluster Storage 3 | grafana | 5.2.4-6.el7rhgs | RHSA-2023:1486 |
| Red Hat Gluster Storage 3 | rubygem-puma +1 | 4.3.12-1.el7rhgs | RHSA-2023:1486 |
| Red Hat Gluster Storage 3 | rubygem-rack +1 | 2.2.4-1.el7rhgs | RHSA-2023:1486 |
| Red Hat Gluster Storage 3 | rubygem-tzinfo +1 | 1.2.10-1.el7rhgs | RHSA-2023:1486 |
| Red Hat Ceph Storage 6 | ansible-collection-ansible-posix | 1.2.0-1.3.el9ost | RHSA-2023:3623 |
| Red Hat Ceph Storage 6 | ceph +26 | 2:17.2.6-70.el9cp | RHSA-2023:3623 |
| Red Hat Ceph Storage 6 | cephadm-ansible | 2.15.0-1.el9cp | RHSA-2023:3623 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Server Module 4.2 | cobbler | 3.1.2-150300.5.19.1 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | drools | 7.17.0-150300.4.6.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | grafana-formula | 0.8.1-150300.3.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | httpcomponents-asyncclient | 4.1.4-150300.3.3.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | image-sync-formula | 0.1.1661440526.b08d95b-150300.3.3.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | inter-server-sync | 0.2.3-150300.8.22.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | mgr-osad | 4.2.9-150300.2.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | patterns-suse-manager | 4.2-150300.4.12.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | prometheus-formula | 0.7.0-150300.3.17.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | py27-compat-salt | 3000.3-150300.7.7.23.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | rhnlib | 4.2.7-150300.4.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | salt-netapi-client | 0.20.0-150300.3.9.4 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | saltboot-formula | 0.1.1661440526.b08d95b-150300.3.12.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | smdba | 1.7.11-0.150300.3.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | spacecmd | 4.2.19-150300.4.27.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-admin | 4.2.12-150300.3.15.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-backend | 4.2.24-150300.4.29.5 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-certs-tools | 4.2.18-150300.3.24.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-client-tools | 4.2.20-150300.4.24.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-java | 4.2.41-150300.3.43.5 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-search | 4.2.8-150300.3.12.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | spacewalk-web | 4.2.29-150300.3.27.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | subscription-matcher | 0.29-150300.6.12.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | supportutils-plugin-susemanager | 4.2.5-150300.3.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager | 4.2.37-150300.3.41.1 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | susemanager-build-keys | 15.3.6-150300.3.6.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | susemanager-doc-indexes | 4.2-150300.12.33.4 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | susemanager-docs_en | 4.2-150300.12.33.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | susemanager-schema | 4.2.24-150300.3.27.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | susemanager-sls | 4.2.27-150300.3.33.4 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | uyuni-common-libs | 4.2.7-150300.3.9.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Server Module 4.2 | virtual-host-gatherer | 1.0.24-150300.3.9.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server Module 4.2 | woodstox | 4.4.2-150300.3.6.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Server 4.3 | release-notes-susemanager | 4.3.2-150400.3.15.1 | SUSE-SU-2022:3761-1 |
| SUSE Manager Server 4.2 | release-notes-susemanager | 4.2.9-150300.3.54.1 | SUSE-SU-2022:3313-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Manager Retail Branch Server 4.3 | release-notes-susemanager-proxy | 4.3.2-150400.3.9.3 | SUSE-SU-2022:3761-1 |
| SUSE Manager Retail Branch Server 4.2 | release-notes-susemanager-proxy | 4.2.9-150300.3.43.1 | SUSE-SU-2022:3313-1 |
| SUSE Manager Proxy Module 4.2 | mgr-daemon | 4.2.10-150300.2.9.4 | SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | mgr-osad | 4.2.9-150300.2.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | patterns-suse-manager | 4.2-150300.4.12.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | rhnlib | 4.2.7-150300.4.12.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacecmd | 4.2.19-150300.4.27.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-backend | 4.2.24-150300.4.29.5 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-certs-tools | 4.2.18-150300.3.24.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-client-tools | 4.2.20-150300.4.24.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-proxy | 4.2.12-150300.3.21.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-proxy-installer | 4.2.11-150300.3.14.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | spacewalk-web | 4.2.29-150300.3.27.3 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | susemanager-build-keys | 15.3.6-150300.3.6.2 | SUSE-SU-2023:0592-1 |
| SUSE Manager Proxy Module 4.2 | susemanager-tftpsync-recv | 4.2.5-150300.3.6.2 | SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy Module 4.2 | uyuni-common-libs | 4.2.7-150300.3.9.2 | SUSE-SU-2023:0592-1, SUSE-SU-2022:3314-1 |
| SUSE Manager Proxy 4.3 | release-notes-susemanager-proxy | 4.3.2-150400.3.9.3 | SUSE-SU-2022:3761-1 |
| SUSE Manager Proxy 4.2 | release-notes-susemanager-proxy | 4.2.9-150300.3.43.1 | SUSE-SU-2022:3313-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | moment | >= 2.18.0, < 2.29.4 | 2.29.4 | GHSA-wc69-rhjr-hc9g |
| NuGet | Moment.js | >= 2.18.0, < 2.29.4 | 2.29.4 | GHSA-wc69-rhjr-hc9g |
Advisories 34
- RHSA-2022:6277 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.1.5 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2023:3623 Red Hat Security Advisory: Red Hat Ceph Storage 6.1 security and bug fix update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1486 Red Hat Security Advisory: Red Hat Gluster Storage web-admin-build security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1045 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1044 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 8 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2023:1043 Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:6392 Red Hat Security Advisory: RHV RHEL Host (ovirt-host) [ovirt-4.5.2] security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:6393 Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2022:6272 Red Hat Security Advisory: Red Hat OpenShift Service Mesh 2.0.11 security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2023-1350 Splunk Splunk Enterprise: Mehrere Schwachstellen in Komponenten von Drittanbietern BSI CERT-Bund (WID) · Jul 1, 2026
- WID-SEC-2022-1776 Oracle MySQL: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2026
- USN-6550-1 postfixadmin vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- USN-5559-1 node-moment vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3295-1 node-moment - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:3314-1 Security update for SUSE Manager Server 4.2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:0592-1 Security update for SUSE Manager Server 4.2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3313-1 Security update for release-notes-susemanager, release-notes-susemanager-proxy SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:3761-1 Security update for release-notes-susemanager, release-notes-susemanager-proxy SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1542 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-1489 Red Hat Enterprise Linux Ceph Storage: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-0395 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2022-0944 Red Hat OpenShift Service Mesh: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2023-2229 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 18, 2025
- WID-SEC-2022-1738 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 3, 2025
- WID-SEC-2023-0137 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- WID-SEC-2024-0528 Dell Data Protection Advisor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 29, 2024
- WID-SEC-2023-0809 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2024
- WID-SEC-2023-2684 Oracle Utilities Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023
- WID-SEC-2023-1808 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 18, 2023
- WID-SEC-2023-1021 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 29, 2023
- WID-SEC-2022-1476 SUSE Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 2, 2023
- WID-SEC-2023-0026 IBM Maximo Asset Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 19, 2023
- WID-SEC-2023-0125 Oracle PeopleSoft: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 17, 2023
- WID-SEC-2022-2368 HCL BigFix: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 9, 2023
References
- https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g
- https://github.com/moment/moment/pull/6015#issuecomment-1152961973
- https://github.com/moment/moment/commit/9a3b5894f3d5d602948ac8a02e4ee528a49ca3a3
- https://huntr.dev/bounties/f0952b67-f2ff-44a9-a9cd-99e0a87cb633/
- FEDORA-2022-85aa8e5706 vendor-advisory
- FEDORA-2022-35b698150c vendor-advisory
- FEDORA-2022-b9ef7c3c3c vendor-advisory
- FEDORA-2022-798fd95813 vendor-advisory
- https://security.netapp.com/advisory/ntap-20221014-0003/
- [debian-lts-announce] 20230130 [SECURITY] [DLA 3295-1] node-moment security update mailing-list