Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 19, 2025 | Nov 18, 2025 |
| Centos_linux | — | Upgrade python3-ceph-commonUpgrade librgw2-debuginfoUpgrade ceph-mibUpgrade rbd-fuse-debuginfoUpgrade ceph-immutable-object-cache-debuginfoUpgrade libradosstriper1Upgrade ceph-mon-debuginfoUpgrade python3-rgwUpgrade rbd-mirrorUpgrade ceph-debugsourceUpgrade ceph-radosgwUpgrade ceph-selinuxUpgrade ceph-osd-debuginfoUpgrade cephfs-topUpgrade python3-cephfsUpgrade ceph-commonUpgrade ceph-fuse-debuginfoUpgrade python3-rbdUpgrade ceph-common-debuginfoUpgrade ceph-mdsUpgrade libcephsqlite-debuginfoUpgrade python3-radosUpgrade ceph-ansibleUpgrade librgw2Upgrade libradosstriper1-debuginfoUpgrade librbd-develUpgrade python3-ceph-argparseUpgrade python3-rados-debuginfoUpgrade libcephfs2Upgrade ceph-resource-agentsUpgrade ceph-test-debuginfoUpgrade ceph-mgr-debuginfoUpgrade rbd-mirror-debuginfoUpgrade python3-rgw-debuginfoUpgrade libcephfs-develUpgrade librgw-develUpgrade ceph-immutable-object-cacheUpgrade cephfs-mirrorUpgrade ceph-grafana-dashboardsUpgrade ceph-base-debuginfoUpgrade rbd-nbdUpgrade ceph-baseUpgrade cephfs-mirror-debuginfoUpgrade cephadmUpgrade ceph-radosgw-debuginfoUpgrade ceph-iscsiUpgrade rbd-nbd-debuginfoUpgrade librados-devel-debuginfoUpgrade ceph-fuseUpgrade python3-rbd-debuginfoUpgrade librados-develUpgrade ceph-mds-debuginfoUpgrade libcephfs2-debuginfoUpgrade libradospp-develUpgrade python3-cephfs-debuginfo | Jan 12, 2023 | Apr 4, 2022 |
| Debian | — | Upgrade node-moment | Feb 1, 2023 | Apr 4, 2022 |
| Red Hat Jboss Eap | — | Upgrade Red Hat JBoss EAP to the latest version | Sep 19, 2024 | Apr 4, 2022 |
| Red_hat Jboss_eap | — | — | Apr 10, 2023 | Apr 4, 2022 |
| Redhat_linux | — | Upgrade ceph-commonUpgrade libradosstriper1-debuginfoUpgrade ceph-mibUpgrade libcephsqlite-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-ansibleUpgrade ceph-radosgwUpgrade cephfs-mirror-debuginfoUpgrade ceph-resource-agentsUpgrade ceph-fuse-debuginfoUpgrade librgw2-debuginfoUpgrade librbd-develUpgrade libradospp-develUpgrade libradosstriper1Upgrade ceph-common-debuginfoUpgrade ceph-fuseUpgrade cephfs-topUpgrade rbd-nbdUpgrade librados-devel-debuginfoUpgrade rbd-mirrorUpgrade libcephfs-develUpgrade python3-rbd-debuginfoUpgrade ceph-immutable-object-cacheUpgrade python3-rbdUpgrade ceph-baseUpgrade ceph-iscsiUpgrade cephadmUpgrade python3-rgw-debuginfoNo solution existsUpgrade ceph-mds-debuginfoUpgrade python3-radosUpgrade ceph-selinuxUpgrade python3-rgwUpgrade ceph-immutable-object-cache-debuginfoUpgrade ceph-test-debuginfoUpgrade python3-ceph-commonUpgrade rbd-mirror-debuginfoUpgrade librados-develUpgrade ceph-osd-debuginfoUpgrade librgw-develUpgrade ceph-mon-debuginfoUpgrade rbd-nbd-debuginfoUpgrade ceph-mgr-debuginfoUpgrade libcephfs2Upgrade librgw2Upgrade ceph-mdsUpgrade python3-rados-debuginfoUpgrade python3-cephfsUpgrade python3-cephfs-debuginfoUpgrade libcephfs2-debuginfoUpgrade ceph-debugsourceUpgrade ceph-base-debuginfoUpgrade python3-ceph-argparseUpgrade cephfs-mirrorUpgrade ceph-grafana-dashboardsUpgrade ceph-radosgw-debuginfo | Jan 12, 2023 | Apr 4, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.4Upgrade Splunk Enterprise to version 8.2.10Upgrade Splunk Enterprise to version 8.1.13 | Sep 30, 2025 | Apr 4, 2022 |
| Ubuntu | — | Upgrade libjs-momentUpgrade node-moment | Aug 11, 2022 | Apr 4, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub