p PatchFirst

CVE-2026-17495

CVE-2026-17495 · moment vulnerable to Path Traversal via crafted non-string locale name

This page contains facts from public vulnerability sources. Check the original advisory before updating.

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().

CVSS 5.9 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • moment

    Versions
    • ≥ 2.29.2, < 2.31.0: Affected (semver)
    • 2.31.0: Not affected (semver)

    Update to 2.31.0

  • node-moment Debian:12

    Versions
    • 2.29.4+ds-1
    • 2.30.1+ds-1
    • 2.30.1+ds1-1
    • 2.30.1+ds1-2
    • 2.30.1+ds1-3
    • 2.31.0+ds1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Debian:13

    Versions
    • 2.29.4+ds-1
    • 2.30.1+ds-1
    • 2.30.1+ds1-1
    • 2.30.1+ds1-2
    • 2.30.1+ds1-3
    • 2.31.0+ds1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Debian:14

    Versions
    • 2.29.4+ds-1
    • 2.30.1+ds-1
    • 2.30.1+ds1-1
    • 2.30.1+ds1-2
    • 2.30.1+ds1-3
    Affected ranges
    • ECOSYSTEM: < 2.31.0+ds1-1

    Update to 2.31.0+ds1-1

  • moment npm

    Affected ranges
    • SEMVER: ≥ 2.29.2, < 2.31.0

    Update to 2.31.0

  • node-moment Ubuntu:Pro:16.04:LTS

    Versions
    • 2.10.6+dfsg-1
    • 2.11.0+ds-1
    • 2.11.0+ds-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Ubuntu:18.04:LTS

    Versions
    • 2.18.1+ds-1
    • 2.19.1+ds-1
    • 2.19.2+ds-1
    • 2.19.3+ds-1
    • 2.19.4+ds-1
    • 2.20.1+ds-1
    • 2.20.1+ds-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Ubuntu:20.04:LTS

    Versions
    • 2.24.0+ds-1
    • 2.24.0+ds-2
    • 2.24.0+ds-2ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Ubuntu:22.04:LTS

    Versions
    • 2.29.1+ds-2
    • 2.29.1+ds-3
    • 2.29.1+ds-3ubuntu0.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-xstatic-moment Ubuntu:22.04:LTS

    Versions
    • 2.8.4.2-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Ubuntu:24.04:LTS

    Versions
    • 2.29.4+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-xstatic-moment Ubuntu:24.04:LTS

    Versions
    • 2.8.4.2-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Ubuntu:26.10

    Versions
    • 2.30.1+ds-1
    • 2.30.1+ds1-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-xstatic-moment Ubuntu:26.10

    Versions
    • 2.8.4.2-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-moment Ubuntu:26.04:LTS

    Versions
    • 2.29.4+ds-1
    • 2.30.1+ds-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • python-xstatic-moment Ubuntu:26.04:LTS

    Versions
    • 2.8.4.2-4
    • 2.8.4.2-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →