Is CVE-2017-18214 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2017-18214 being exploited in the wild.

How severe is CVE-2017-18214?

Low severity, with a CVSS score of 3.1, published 5 March 2018.

Which products and versions are affected?

moment (npm) SEMVER:introduced=0,fixed=2.19.3.

Is there a fix for CVE-2017-18214?

Yes. moment (npm): upgrade to 2.19.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2017-18214 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2017-18214?

Check whether you run moment (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2017-18214: moment Regular Expression Denial of Service in date parsing

CVE-2017-18214 · Severity: low · CVSS 3.1 · Published 2018-03-05

moment is a popular JavaScript library used to parse, validate, and display dates. The library is vulnerable to a denial of service attack when processing specially crafted date strings, allowing an attacker to cause excessive CPU consumption and hang application threads. This could impact the availability of any application or service relying on moment for date handling.

Technologies: moment (npm). Vendors: npm.

Quick answers

Is CVE-2017-18214 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2017-18214 being exploited in the wild.
How severe is CVE-2017-18214?: Low severity, with a CVSS score of 3.1, published 5 March 2018.
Which products and versions are affected?: moment (npm) SEMVER:introduced=0,fixed=2.19.3.
Is there a fix for CVE-2017-18214?: Yes. moment (npm): upgrade to 2.19.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2017-18214 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2017-18214?: Check whether you run moment (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

moment (npm): upgrade to 2.19.3 or later
```
npm install moment@2.19.3
```

Technical details

The vulnerability is a Regular Expression Denial of Service (ReDoS) in moment's date parsing logic, classified as CWE-400 (Uncontrolled Resource Consumption). Affected versions use a regular expression pattern vulnerable to catastrophic backtracking when parsing maliciously crafted date strings. An attacker can supply a specially constructed string to the parsing functions to cause the regex engine to enter an exponential backtracking loop, consuming significant CPU resources and potentially making the application unresponsive. No authentication or special privileges are required—any input from an attacker reachable via the network or local context can trigger the issue. The fix, released in version 2.19.3 (merged November 2017), limits regex matching to 256 characters and constrains number patterns, preventing excessive backtracking.

Affected products

moment moment < 2.19.3

Identifiers

CVE-2017-18214
GHSA-446m-mv8f-q348

Timeline

2018-03-05: disclosed: Published to GitHub Advisory Database
2017-11-29: patched: Fix merged into moment/develop via PR #4326 and commit 69ed9d4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.