CVE-2020-26289: Regular Expression Denial of Service (ReDoS) in date-and-time npm package
Summary
CVE-2020-26289: regular expression denial of service (ReDoS). Affects date-and-time versions < 0.14.2. Fixed in 0.14.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The date-and-time npm package is a library used for manipulating date and time in JavaScript applications. It provides various functions and utilities for parsing, formatting, and manipulating dates and times. The package is widely used in Node.js and web applications to handle date and time-related operations. However, versions prior to 0.14.2 are vulnerable to a regular expression denial of service (ReDoS) attack.
Vulnerability Detail
The vulnerability in the date-and-time npm package (versions before 0.14.2) is due to a regular expression used in the parsing mechanism. An attacker can exploit this vulnerability by providing specially crafted input that triggers a ReDoS attack. This can lead to a denial of service, where the application becomes unresponsive or consumes excessive CPU resources. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Latest published version: 4.6.0 as of 23 Oct 2026
npm install date-and-time@4.6.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14.2
This is the first release that contains the fix.
npm install date-and-time@0.14.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the package to the fixed version as soon as possible.
Conclusion
The date-and-time npm package (versions before 0.14.2) is vulnerable to a regular expression denial of service (ReDoS) attack. This can lead to a denial of service, impacting the availability and performance of the application. It is recommended to update the package to version 0.14.2 or later to fix this vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for date-and-time →
FAQ
The date-and-time npm package is used for manipulating date and time in JavaScript applications. It provides functions for parsing, formatting, and manipulating dates and times.
A regular expression denial of service (ReDoS) attack is a type of vulnerability where a malicious user can provide input that causes a regular expression to take an excessive amount of time to evaluate. This can lead to a denial of service, where the application becomes unresponsive or consumes excessive CPU resources.
The vulnerability in the date-and-time npm package can be exploited to cause a denial of service. This can result in the application becoming unresponsive or consuming excessive CPU resources, impacting its availability and performance.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
To fix this vulnerability, you should update the date-and-time package to version 0.14.2 or later. This version includes a fix for the regular expression that mitigates the ReDoS vulnerability. You can update the package by running the following command in your project's root directory: npm install date-and-time@0.14.2
