p PatchFirst

CVE-2016-4055

CVE-2016-4055

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."

CVSS 6.5 · Medium · EPSS 9.9% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • node-moment Debian:12

    Affected ranges
    • ECOSYSTEM: < 2.13.0+ds-1

    Update to 2.13.0+ds-1

  • node-moment Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.13.0+ds-1

    Update to 2.13.0+ds-1

  • node-moment Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.13.0+ds-1

    Update to 2.13.0+ds-1

  • moment npm

    Affected ranges
    • SEMVER: < 2.11.2

    Update to 2.11.2

  • node-moment Ubuntu:Pro:16.04:LTS

    Versions
    • 2.10.6+dfsg-1
    • 2.11.0+ds-1
    Affected ranges
    • ECOSYSTEM: < 2.11.0+ds-1ubuntu0.1~esm1

    Update to 2.11.0+ds-1ubuntu0.1~esm1

Original sources

Check your server →