Vulnerability · Published Sep 15, 2026 · Assigned by openjs
CVE-2026-17495moment vulnerable to Path Traversal via crafted non-string locale name
Medium 5.9
In plain English
A medium-severity security flaw in moment from moment. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specially crafted non-string object passed to moment.locale() can bypass the locale-name path-traversal guard. The guard assumes the input is a string, so an object whose match() method satisfies the check while its toString() returns a traversal path reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for CVE-2022-24785 and primarily affects npm (server-side) users that pass user-provided input directly to moment.locale(). The issue is fixed in moment 2.31.0, and users should upgrade to 2.31.0 or later. As a workaround, validate that any user-supplied input is a string before passing it to moment.locale().
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-moment | no fix listed | DEBIAN-CVE-2026-17495 |
| Debian:13 | node-moment | no fix listed | DEBIAN-CVE-2026-17495 |
| Debian:14 | node-moment | 2.31.0+ds1-1 | DEBIAN-CVE-2026-17495 |
| Ubuntu:22.04:LTS | node-moment | no fix listed | UBUNTU-CVE-2026-17495 |
| Ubuntu:24.04:LTS | node-moment | no fix listed | UBUNTU-CVE-2026-17495 |
| Ubuntu:26.04:LTS | node-moment | no fix listed | UBUNTU-CVE-2026-17495 |
| Ubuntu:26.10 | node-moment | no fix listed | UBUNTU-CVE-2026-17495 |
| Ubuntu:22.04:LTS | python-xstatic-moment | no fix listed | UBUNTU-CVE-2026-17495 |
| Ubuntu:24.04:LTS | python-xstatic-moment | no fix listed | UBUNTU-CVE-2026-17495 |
| Ubuntu:26.04:LTS | python-xstatic-moment | no fix listed | UBUNTU-CVE-2026-17495 |
| Ubuntu:26.10 | python-xstatic-moment | no fix listed | UBUNTU-CVE-2026-17495 |
| npm | moment | 2.31.0 | GHSA-4p3w-j4w9-5jqw |
Affected products (as reported)
Weakness: CWE-27 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N