Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 19, 2025 | Nov 18, 2025 |
| Centos_linux | — | Upgrade ceph-commonUpgrade ceph-radosgwUpgrade python3-rgwUpgrade ceph-osd-debuginfoUpgrade ceph-mon-debuginfoUpgrade python3-cephfsUpgrade python3-rados-debuginfoUpgrade librgw2Upgrade ceph-mibUpgrade ceph-common-debuginfoUpgrade ceph-ansibleUpgrade libcephsqlite-debuginfoUpgrade libradosstriper1-debuginfoUpgrade librgw2-debuginfoUpgrade ceph-debugsourceUpgrade ceph-mdsUpgrade ceph-selinuxUpgrade python3-radosUpgrade cephfs-topUpgrade ceph-fuse-debuginfoUpgrade python3-rbdUpgrade python3-ceph-commonUpgrade rbd-fuse-debuginfoUpgrade rbd-mirrorUpgrade python3-ceph-argparseUpgrade ceph-immutable-object-cache-debuginfoUpgrade librbd-develUpgrade libradosstriper1Upgrade python3-cephfs-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-fuseUpgrade cephfs-mirrorUpgrade cephfs-mirror-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-iscsiUpgrade cephadmUpgrade ceph-radosgw-debuginfoUpgrade rbd-nbd-debuginfoUpgrade rbd-nbdUpgrade ceph-base-debuginfoUpgrade ceph-baseUpgrade python3-rbd-debuginfoUpgrade librados-develUpgrade ceph-resource-agentsUpgrade ceph-grafana-dashboardsUpgrade libradospp-develUpgrade libcephfs2-debuginfoUpgrade ceph-immutable-object-cacheUpgrade librgw-develUpgrade libcephfs2Upgrade libcephfs-develUpgrade ceph-test-debuginfoUpgrade ceph-mgr-debuginfoUpgrade python3-rgw-debuginfoUpgrade rbd-mirror-debuginfo | Jan 12, 2023 | Apr 4, 2022 |
| Debian | — | Upgrade node-moment | Feb 1, 2023 | Apr 4, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 4, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 4, 2022 |
| Redhat_linux | — | Upgrade cephfs-mirrorUpgrade librgw-develUpgrade python3-ceph-argparseUpgrade librados-develUpgrade ceph-mon-debuginfoUpgrade ceph-osd-debuginfoUpgrade ceph-mgr-debuginfoUpgrade python3-rados-debuginfoUpgrade libcephfs2-debuginfoUpgrade python3-cephfsUpgrade ceph-radosgw-debuginfoUpgrade python3-rgwUpgrade ceph-mdsUpgrade python3-cephfs-debuginfoUpgrade rbd-mirror-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-base-debuginfoUpgrade ceph-immutable-object-cache-debuginfoUpgrade ceph-debugsourceUpgrade libcephfs2Upgrade ceph-grafana-dashboardsUpgrade librgw2Upgrade python3-ceph-commonUpgrade ceph-test-debuginfoNo solution existsUpgrade ceph-fuseUpgrade librbd-develUpgrade rbd-nbdUpgrade librgw2-debuginfoUpgrade ceph-mibUpgrade rbd-mirrorUpgrade libradosstriper1Upgrade librados-devel-debuginfoUpgrade ceph-mds-debuginfoUpgrade libcephfs-develUpgrade cephfs-topUpgrade python3-radosUpgrade cephfs-mirror-debuginfoUpgrade python3-rgw-debuginfoUpgrade ceph-radosgwUpgrade ceph-commonUpgrade ceph-resource-agentsUpgrade ceph-selinuxUpgrade ceph-fuse-debuginfoUpgrade ceph-common-debuginfoUpgrade ceph-iscsiUpgrade python3-rbdUpgrade ceph-ansibleUpgrade python3-rbd-debuginfoUpgrade ceph-immutable-object-cacheUpgrade ceph-baseUpgrade libradospp-develUpgrade rbd-fuse-debuginfoUpgrade libradosstriper1-debuginfoUpgrade cephadmUpgrade libcephsqlite-debuginfo | Jan 12, 2023 | Apr 4, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.4Upgrade Splunk Enterprise to version 8.2.10Upgrade Splunk Enterprise to version 8.1.13 | Sep 30, 2025 | Apr 4, 2022 |
| Ubuntu | — | Upgrade node-momentUpgrade libjs-moment | Aug 11, 2022 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub