Denial of Service Vulnerability in node-moment
Summary
CVE-2016-4055: The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS).". Affects node-moment across 2 version ranges.
< 2.13.0+ds-1
< dd9cff0104c0dc3f114f54107397c59920e764cc
Fixed in 2.13.0+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-moment is a package for Node.js that provides date and time manipulation functionality. It is widely used in various applications and frameworks. However, a vulnerability has been discovered in versions prior to 2.11.2 that can lead to a denial of service (CPU consumption) when processing long strings. This vulnerability is classified as a regular expression Denial of Service (ReDoS) and can be exploited remotely.
Vulnerability Detail
The duration function in the moment package for Node.js is susceptible to a denial of service attack. By providing a long string as input, an attacker can cause excessive CPU consumption, leading to a degradation in system performance and potentially rendering the affected application unresponsive. This vulnerability can be exploited remotely, making it a significant concern for applications utilizing node-moment.
How To Fix
Minimum fixed version
2.13.0+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-momentTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the node-moment package to the fixed version to address the issue effectively.
Conclusion
The node-moment package for Node.js is vulnerable to a denial of service attack. It is crucial to update to version 2.13.0 or later to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for node-moment →
FAQ
This vulnerability can lead to a denial of service, causing excessive CPU consumption and potentially rendering the affected application unresponsive.
Yes, this vulnerability can be exploited remotely, making it a significant concern for applications utilizing node-moment.
Versions prior to 2.11.2 of the node-moment package for Node.js are affected by this vulnerability.
No, there is no known workaround for this vulnerability. It is crucial to update the node-moment package to the fixed version.
To fix this vulnerability, update the node-moment package to version 2.13.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for node-moment.
