# CVE-2026-17495: moment path traversal via crafted non-string locale name

Source: https://junglewise.ai/threats/cve-2026-17495-moment-path-traversal-via-crafted-non-string-locale-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-15. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-17495 · Severity: medium · CVSS 5.9 · Published 2026-09-15

moment is a popular JavaScript library used for parsing and formatting dates in web and Node.js applications. A vulnerability in versions 2.29.2 through 2.30.1 allows attackers to bypass locale name validation by passing specially crafted objects, potentially causing the library to load files from attacker-controlled paths. This primarily affects server-side deployments where user input is passed directly to the moment.locale() function, risking unauthorized file access and code execution.

Technologies: [moment (npm)](https://junglewise.ai/threats/technologies/npm-moment). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-17495 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-17495 being exploited in the wild.

**How severe is CVE-2026-17495?** Medium severity, with a CVSS score of 5.9, published 15 September 2026.

**Which products and versions are affected?** moment (npm) >= 2.29.2, < 2.31.0, SEMVER:introduced=2.29.2,fixed=2.31.0.

**Is there a fix for CVE-2026-17495?** Yes. moment (npm): upgrade to 2.31.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-17495 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-17495?** Check whether you run moment (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- moment (npm): upgrade to 2.31.0 or later

  ```sh
  npm install moment@2.31.0
  ```


## Technical details

The vulnerability is a path traversal flaw (CWE-27) in moment's locale name validation. The guard in moment.locale() assumes input is a string and checks for path separators, but when a non-string object is passed, an attacker can craft an object whose match() method passes validation while its toString() method returns a traversal path (e.g., with ../ sequences). This bypassed value reaches an internal require() call with attacker-controlled path segments. This is an incomplete fix for the earlier CVE-2022-24785 path traversal vulnerability. The attack requires the application to pass unsanitized, user-supplied input directly to moment.locale() on the server side (npm usage). The vulnerability is fixed in moment 2.31.0.

## Affected products

- moment.js moment 2.29.2 through 2.30.1

## Identifiers

- CVE-2026-17495
- GHSA-4p3w-j4w9-5jqw

## Timeline

- 2026-09-15: disclosed
- 2026-09-15: patched: Fixed in version 2.31.0

## References

- [https://cna.openjsf.org/security-advisories.html](https://cna.openjsf.org/security-advisories.html)
- [https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw](https://github.com/moment/moment/security/advisories/GHSA-4p3w-j4w9-5jqw)

## Related threats

- [Moment.js regular expression denial of service in duration function](https://junglewise.ai/threats/moment-js-regular-expression-denial-of-service-in-duration-function-a67ded15)
- [moment Regular Expression Denial of Service in date parsing](https://junglewise.ai/threats/cve-2017-18214-moment-regular-expression-denial-of-service-in-date-parsing)
- [Moment.js ReDoS in duration function](https://junglewise.ai/threats/cve-2016-4055-moment-js-redos-in-duration-function)