Executive brief
moment is a popular JavaScript library used for parsing and formatting dates in web and Node.js applications. A vulnerability in versions 2.29.2 through 2.30.1 allows attackers to bypass locale name validation by passing specially crafted objects, potentially causing the library to load files from attacker-controlled paths. This primarily affects server-side deployments where user input is passed directly to the moment.locale() function, risking unauthorized file access and code execution.
Technical details
The vulnerability is a path traversal flaw (CWE-27) in moment's locale name validation. The guard in moment.locale() assumes input is a string and checks for path separators, but when a non-string object is passed, an attacker can craft an object whose match() method passes validation while its toString() method returns a traversal path (e.g., with ../ sequences). This bypassed value reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for the earlier CVE-2022-24785 path traversal vulnerability. The attack requires the application to pass unsanitized, user-supplied input directly to moment.locale() on the server side (npm usage). The vulnerability is fixed in moment 2.31.0.
Affected products
- moment.js moment 2.29.2 through 2.30.1
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in version 2.31.0