Regular Expression Denial of Service in moment

높음 7.5CVE-2017-18214 · GHSA-446m-mv8f-q348 · Published 04/03/2018 · updated 17/06/2026

요약

CVE-2017-18214은(는) moment (momentjs), nessus (tenable), moment에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 3.6%, 전체 취약점의 89.6%보다 높음.
조치: 2.19.3 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
moment momentjs	`≤ 2.19.2`	No fix yet
nessus tenable	`≤ 8.2.3`	No fix yet
moment npm	`< 2.19.3`	`2.19.3`

Description

Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.

Recommendation

Update to version 2.19.3 or later.

NVD description

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.

References

nvd.nist.gov/vuln/detail/CVE-2017-18214 · ADVISORY
moment/moment · WEB
moment/moment#4326 · WEB
moment/moment commit 69ed9d4 · WEB
GitHub Advisory GHSA-446m-mv8f-q348 · ADVISORY
moment/moment · PACKAGE
npmjs.com/advisories/532 · WEB
tenable.com/security/tns-2019-02 · WEB
nodesecurity.io/advisories/532 · Not Applicable

moment의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

moment

momentjs

≤ 2.19.2

No fix yet

nessus

tenable

≤ 8.2.3

No fix yet

moment

npm

< 2.19.3

2.19.3

Description

Affected versions of moment are vulnerable to a low severity regular expression denial of service when parsing dates as strings.

Recommendation

Update to version 2.19.3 or later.

NVD description

The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.

moment의 다른 취약점

모두 보기 →