# Moment.js regular expression denial of service in duration function

Source: https://junglewise.ai/threats/moment-js-regular-expression-denial-of-service-in-duration-function-a67ded15  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2018-07-31. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: info · Published 2018-07-31

Moment.js is a popular JavaScript library for parsing, validating, and formatting dates and times. A vulnerability in the duration function allows an attacker to submit a specially crafted long string that causes excessive CPU consumption, potentially leading to service unavailability or denial of service conditions for applications relying on this library.

Technologies: [moment (npm)](https://junglewise.ai/threats/technologies/npm-moment). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Informational severity, published 31 July 2018.

**Which products and versions are affected?** moment (npm) SEMVER:introduced=0,fixed=2.11.2.

**Is there a fix for This vulnerability?** Yes. moment (npm): upgrade to 2.11.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network.

**Am I affected?** Check whether you run moment (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- moment (npm): upgrade to 2.11.2 or later

  ```sh
  npm install moment@2.11.2
  ```


## Technical details

This vulnerability is a Regular Expression Denial of Service (ReDoS) flaw in the duration function of moment.js. The vulnerable component uses a regex pattern that exhibits exponential backtracking behavior when processing certain input strings, allowing an attacker to craft long strings that trigger excessive CPU consumption. The attack vector is network-based and requires no authentication—any application accepting untrusted input and passing it to the duration function is at risk. The vulnerability affects versions before 2.11.2, which includes a fix for the problematic regex pattern. This advisory was withdrawn as an accidental duplicate of CVE-2016-4055.

## Affected products

- Moment.js Moment before 2.11.2

## Timeline

- 2018-07-31: disclosed: Advisory published to GitHub Advisory Database
- 2011-02-01: patched: Fixed in version 2.11.2
- 2020-06-17: other: Advisory withdrawn as accidental duplicate of CVE-2016-4055

## Related threats

- [moment path traversal via crafted non-string locale name](https://junglewise.ai/threats/cve-2026-17495-moment-path-traversal-via-crafted-non-string-locale-name)
- [moment Regular Expression Denial of Service in date parsing](https://junglewise.ai/threats/cve-2017-18214-moment-regular-expression-denial-of-service-in-date-parsing)
- [Moment.js ReDoS in duration function](https://junglewise.ai/threats/cve-2016-4055-moment-js-redos-in-duration-function)