CVE-2017-18214: Regular Expression Denial of Service in moment
Summary
CVE-2017-18214: Regular Expression Denial of Service in moment. Affects moment versions < 2.19.3. Fixed in 2.19.3. How to fix ↓
Also tracked for
- node-moment · Debian:11
The same CVE-2017-18214 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Moment is a popular JavaScript library for parsing, validating, manipulating, and formatting dates. It is widely used in web applications to handle date and time-related operations. However, certain versions of Moment are vulnerable to a low severity regular expression denial of service (ReDoS) when parsing dates as strings.
Vulnerability Detail
The vulnerability arises from the way Moment handles date parsing using regular expressions. An attacker can craft a malicious date string that triggers excessive backtracking in the parsing algorithm, leading to a denial of service condition. This can cause the application to become unresponsive or consume excessive CPU resources. The impact of this vulnerability is relatively low, but it can still disrupt the normal operation of affected applications.
How To Fix
Latest published version: 2.31.0 as of 22 Oct 2026
npm install moment@2.31.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.19.3
This is the first release that contains the fix.
npm install moment@2.19.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating Moment is not immediately feasible, a temporary workaround is to implement input validation and sanitization for date strings before passing them to Moment for parsing. This can help mitigate the risk of exploitation by rejecting or sanitizing malicious input that could trigger the vulnerability.
Conclusion
The vulnerability in Moment can be mitigated by updating to the latest version or implementing input validation. It is recommended to promptly update the Moment package to ensure the security and stability of affected applications. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for moment →
FAQ
Moment is a JavaScript library used for date and time manipulation in web applications.
Regular expression denial of service is a type of attack where an attacker crafts a malicious input that causes a regular expression matching algorithm to exhibit exponential time complexity, leading to a denial of service condition.
The impact of this vulnerability is relatively low, but it can cause affected applications to become unresponsive or consume excessive CPU resources.
To fix this vulnerability, update the Moment package to version 2.19.3 or later.
Yes, you can implement input validation and sanitization for date strings to mitigate the risk of exploitation until the Moment package can be updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for moment.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
