Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 19, 2025 | Nov 18, 2025 |
| Centos_linux | — | Upgrade ceph-fuseUpgrade librados-devel-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-mds-debuginfoUpgrade cephfs-mirror-debuginfoUpgrade ceph-immutable-object-cacheUpgrade ceph-base-debuginfoUpgrade ceph-baseUpgrade ceph-radosgw-debuginfoUpgrade cephfs-mirrorUpgrade python3-cephfs-debuginfoUpgrade rbd-nbdUpgrade ceph-test-debuginfoUpgrade ceph-iscsiUpgrade rbd-mirror-debuginfoUpgrade ceph-mgr-debuginfoUpgrade cephadmUpgrade libcephfs2-debuginfoUpgrade python3-rgw-debuginfoUpgrade libcephfs-develUpgrade libcephfs2Upgrade librgw-develUpgrade libradospp-develUpgrade ceph-grafana-dashboardsUpgrade librados-develUpgrade python3-rbd-debuginfoUpgrade ceph-resource-agentsUpgrade python3-cephfsUpgrade libradosstriper1Upgrade libradosstriper1-debuginfoUpgrade libcephsqlite-debuginfoUpgrade ceph-mdsUpgrade python3-rbdUpgrade python3-radosUpgrade librgw2-debuginfoUpgrade ceph-mibUpgrade python3-rgwUpgrade ceph-common-debuginfoUpgrade librbd-develUpgrade python3-rados-debuginfoUpgrade python3-ceph-argparseUpgrade ceph-debugsourceUpgrade ceph-selinuxUpgrade ceph-fuse-debuginfoUpgrade ceph-commonUpgrade cephfs-topUpgrade librgw2Upgrade ceph-ansibleUpgrade ceph-mon-debuginfoUpgrade ceph-radosgwUpgrade rbd-fuse-debuginfoUpgrade rbd-mirrorUpgrade python3-ceph-commonUpgrade ceph-immutable-object-cache-debuginfoUpgrade ceph-osd-debuginfo | Jan 12, 2023 | Apr 4, 2022 |
| Debian | — | Upgrade node-moment | Feb 1, 2023 | Apr 4, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 4, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 4, 2022 |
| Redhat_linux | — | Upgrade libradosstriper1-debuginfoUpgrade libcephsqlite-debuginfoUpgrade rbd-nbdUpgrade ceph-ansibleUpgrade libradospp-develUpgrade ceph-commonUpgrade librgw2-debuginfoUpgrade ceph-mds-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-mibUpgrade ceph-immutable-object-cacheUpgrade librbd-develUpgrade ceph-fuseUpgrade ceph-iscsiUpgrade python3-rbd-debuginfoUpgrade ceph-radosgwUpgrade librados-devel-debuginfoUpgrade python3-rbdUpgrade ceph-fuse-debuginfoNo solution existsUpgrade ceph-baseUpgrade ceph-selinuxUpgrade python3-rgw-debuginfoUpgrade cephadmUpgrade ceph-common-debuginfoUpgrade libcephfs-develUpgrade python3-radosUpgrade cephfs-mirror-debuginfoUpgrade ceph-resource-agentsUpgrade cephfs-topUpgrade libradosstriper1Upgrade rbd-mirrorUpgrade python3-cephfsUpgrade cephfs-mirrorUpgrade ceph-mdsUpgrade ceph-debugsourceUpgrade ceph-base-debuginfoUpgrade python3-ceph-argparseUpgrade ceph-grafana-dashboardsUpgrade python3-cephfs-debuginfoUpgrade python3-rados-debuginfoUpgrade ceph-immutable-object-cache-debuginfoUpgrade python3-rgwUpgrade ceph-mon-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-mgr-debuginfoUpgrade ceph-test-debuginfoUpgrade libcephfs2Upgrade ceph-osd-debuginfoUpgrade rbd-mirror-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade librgw2Upgrade librgw-develUpgrade python3-ceph-commonUpgrade librados-develUpgrade libcephfs2-debuginfo | Jan 12, 2023 | Apr 4, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 8.2.10Upgrade Splunk Enterprise to version 9.0.4Upgrade Splunk Enterprise to version 8.1.13 | Sep 30, 2025 | Apr 4, 2022 |
| Ubuntu | — | Upgrade node-momentUpgrade libjs-moment | Aug 11, 2022 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub