Executive brief
moment is a popular JavaScript library used to parse, validate, and display dates. The library is vulnerable to a denial of service attack when processing specially crafted date strings, allowing an attacker to cause excessive CPU consumption and hang application threads. This could impact the availability of any application or service relying on moment for date handling.
Technical details
The vulnerability is a Regular Expression Denial of Service (ReDoS) in moment's date parsing logic, classified as CWE-400 (Uncontrolled Resource Consumption). Affected versions use a regular expression pattern vulnerable to catastrophic backtracking when parsing maliciously crafted date strings. An attacker can supply a specially constructed string to the parsing functions to cause the regex engine to enter an exponential backtracking loop, consuming significant CPU resources and potentially making the application unresponsive. No authentication or special privileges are required—any input from an attacker reachable via the network or local context can trigger the issue. The fix, released in version 2.19.3 (merged November 2017), limits regex matching to 256 characters and constrains number patterns, preventing excessive backtracking.
Affected products
- moment moment < 2.19.3
Timeline
- 2018-03-05: disclosed: Published to GitHub Advisory Database
- 2017-11-29: patched: Fix merged into moment/develop via PR #4326 and commit 69ed9d4