CVE-2026-17495: moment path traversal via crafted non-string locale name

CVE-2026-17495 · Severity: medium · CVSS 5.9 · Published 2026-09-15

moment is a popular JavaScript library used for parsing and formatting dates in web and Node.js applications. A vulnerability in versions 2.29.2 through 2.30.1 allows attackers to bypass locale name validation by passing specially crafted objects, potentially causing the library to load files from attacker-controlled paths. This primarily affects server-side deployments where user input is passed directly to the moment.locale() function, risking unauthorized file access and code execution.

Technologies: moment (npm). Vendors: npm.

Quick answers

Is CVE-2026-17495 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-17495 being exploited in the wild.
How severe is CVE-2026-17495?
Medium severity, with a CVSS score of 5.9, published 15 September 2026.
Which products and versions are affected?
moment (npm) >= 2.29.2, < 2.31.0, SEMVER:introduced=2.29.2,fixed=2.31.0.
Is there a fix for CVE-2026-17495?
Yes. moment (npm): upgrade to 2.31.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-17495 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-17495?
Check whether you run moment (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • moment (npm): upgrade to 2.31.0 or later
    npm install moment@2.31.0

Technical details

The vulnerability is a path traversal flaw (CWE-27) in moment's locale name validation. The guard in moment.locale() assumes input is a string and checks for path separators, but when a non-string object is passed, an attacker can craft an object whose match() method passes validation while its toString() method returns a traversal path (e.g., with ../ sequences). This bypassed value reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for the earlier CVE-2022-24785 path traversal vulnerability. The attack requires the application to pass unsanitized, user-supplied input directly to moment.locale() on the server side (npm usage). The vulnerability is fixed in moment 2.31.0.

Affected products

  • moment.js moment 2.29.2 through 2.30.1

Identifiers

  • CVE-2026-17495
  • GHSA-4p3w-j4w9-5jqw

Timeline

  • 2026-09-15: disclosed
  • 2026-09-15: patched: Fixed in version 2.31.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.