Log in Start free

Vulnerability · Published Jul 6, 2022 · Assigned by GitHub_M

CVE-2022-31129Inefficient Regular Expression Complexity in moment

High 7.5

In plain English

A high-severity uncontrolled resource consumption in moment from moment. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.6% (higher than 93% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)5.6%top 7.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-moment2.29.4+ds-1DEBIAN-CVE-2022-31129
Debian:13node-moment2.29.4+ds-1DEBIAN-CVE-2022-31129
Debian:14node-moment2.29.4+ds-1DEBIAN-CVE-2022-31129
NuGetmoment.js2.29.4GHSA-wc69-rhjr-hc9g
Ubuntu:22.04:LTSgnucashno fix listedUBUNTU-CVE-2022-31129
Ubuntu:24.04:LTSgnucashno fix listedUBUNTU-CVE-2022-31129
Ubuntu:25.10gnucashno fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.04:LTSgnucashno fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.10gnucashno fix listedUBUNTU-CVE-2022-31129
Ubuntu:25.10mediawikino fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.04:LTSmediawikino fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.10mediawikino fix listedUBUNTU-CVE-2022-31129
Ubuntu:22.04:LTSnode-moment2.29.1+ds-3ubuntu0.2UBUNTU-CVE-2022-31129
Ubuntu:22.04:LTSnode-moment2.29.1+ds-3ubuntu0.2USN-5559-1
Ubuntu:22.04:LTSntopngno fix listedUBUNTU-CVE-2022-31129
Ubuntu:24.04:LTSntopngno fix listedUBUNTU-CVE-2022-31129
Ubuntu:25.10ntopngno fix listedUBUNTU-CVE-2022-31129
Ubuntu:22.04:LTSodoono fix listedUBUNTU-CVE-2022-31129
Ubuntu:24.04:LTSodoono fix listedUBUNTU-CVE-2022-31129
Ubuntu:25.10odoono fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.04:LTSodoono fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.10odoono fix listedUBUNTU-CVE-2022-31129
Ubuntu:22.04:LTSomnidbno fix listedUBUNTU-CVE-2022-31129
Ubuntu:24.04:LTSomnidbno fix listedUBUNTU-CVE-2022-31129
Ubuntu:25.10omnidbno fix listedUBUNTU-CVE-2022-31129
Ubuntu:25.10postfixadminno fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.04:LTSpostfixadminno fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.10postfixadminno fix listedUBUNTU-CVE-2022-31129
Ubuntu:22.04:LTSruby-momentjs-railsno fix listedUBUNTU-CVE-2022-31129
Ubuntu:24.04:LTSruby-momentjs-railsno fix listedUBUNTU-CVE-2022-31129
Ubuntu:22.04:LTSsabnzbdplusno fix listedUBUNTU-CVE-2022-31129
Ubuntu:24.04:LTSsabnzbdplusno fix listedUBUNTU-CVE-2022-31129
Ubuntu:25.10sabnzbdplusno fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.04:LTSsabnzbdplusno fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.10sabnzbdplusno fix listedUBUNTU-CVE-2022-31129
Ubuntu:25.10syncthingno fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.10syncthingno fix listedUBUNTU-CVE-2022-31129
Ubuntu:22.04:LTSwordpressno fix listedUBUNTU-CVE-2022-31129
Ubuntu:24.04:LTSwordpressno fix listedUBUNTU-CVE-2022-31129
Ubuntu:25.10wordpressno fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.04:LTSwordpressno fix listedUBUNTU-CVE-2022-31129
Ubuntu:26.10wordpressno fix listedUBUNTU-CVE-2022-31129
npmmoment2.29.4GHSA-wc69-rhjr-hc9g

Affected products (as reported)

VendorProductVersions
moment moment >= 2.18.0, < 2.29.4

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References