moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Atlassian Bitbucket | — | Upgrade Atlassian Bitbucket to the latest version | Nov 19, 2025 | Nov 18, 2025 |
| Centos_linux | — | Upgrade librgw2-debuginfoUpgrade ceph-commonUpgrade libcephsqlite-debuginfoUpgrade ansible-collection-ansible-posixUpgrade ceph-fuse-debuginfoUpgrade python3-cephfsUpgrade cephfs-topUpgrade ceph-common-debuginfoUpgrade librados-devel-debuginfoUpgrade libcephfs2-debuginfoUpgrade cephadmUpgrade python3-radosUpgrade ceph-fuseUpgrade rbd-fuse-debuginfoUpgrade ceph-mds-debuginfoUpgrade python3-rgwUpgrade libcephfs-develUpgrade librgw2Upgrade ceph-debuginfoUpgrade librbd-develUpgrade libcephfs2Upgrade librados-develUpgrade cephfs-mirror-debuginfoUpgrade python3-rados-debuginfoUpgrade ceph-immutable-object-cacheUpgrade ceph-immutable-object-cache-debuginfoUpgrade python3-ceph-commonUpgrade rbd-nbdUpgrade ceph-selinuxUpgrade python3-rbdUpgrade ceph-mibUpgrade ceph-osd-debuginfoUpgrade libradosstriper1Upgrade python3-rbd-debuginfoUpgrade librgw-develUpgrade ceph-base-debuginfoUpgrade rbd-nbd-debuginfoUpgrade libradospp-develUpgrade ceph-mon-debuginfoUpgrade python3-ceph-argparseUpgrade rbd-mirror-debuginfoUpgrade ceph-mgr-debuginfoUpgrade ceph-baseUpgrade libradosstriper1-debuginfoUpgrade ceph-resource-agentsUpgrade python3-rgw-debuginfoUpgrade ceph-test-debuginfoUpgrade ceph-debugsourceUpgrade cephadm-ansibleUpgrade ceph-radosgw-debuginfoUpgrade ceph-exporter-debuginfoUpgrade python3-cephfs-debuginfo | Jun 16, 2023 | Jul 6, 2022 |
| Debian | — | Upgrade node-moment | Feb 1, 2023 | Jul 6, 2022 |
| Freebsd | — | Upgrade mantis-php82Upgrade mantis-php81Upgrade mantis-php80Upgrade mantis-php74 | Mar 23, 2023 | Mar 8, 2023 |
| Redhat_linux | — | Upgrade ceph-fuse-debuginfoUpgrade ceph-debugsourceUpgrade rbd-nbd-debuginfoUpgrade ceph-radosgw-debuginfoUpgrade libradosstriper1-debuginfoUpgrade python3-rgwUpgrade ceph-mgr-debuginfoUpgrade ceph-commonUpgrade python3-cephfs-debuginfoUpgrade ceph-immutable-object-cache-debuginfoUpgrade librados-devel-debuginfoUpgrade libcephfs2Upgrade libcephfs2-debuginfoUpgrade libradospp-develUpgrade libcephsqlite-debuginfoUpgrade cephadm-ansibleUpgrade ceph-base-debuginfoUpgrade librgw-develUpgrade python3-rbdUpgrade librados-develUpgrade ceph-baseUpgrade python3-rgw-debuginfoUpgrade python3-rados-debuginfoUpgrade librgw2-debuginfoUpgrade libcephfs-develUpgrade python3-ceph-argparseUpgrade rbd-nbdUpgrade python3-cephfsUpgrade ceph-mon-debuginfoUpgrade python3-ceph-commonUpgrade cephfs-topUpgrade python3-rbd-debuginfoUpgrade librgw2Upgrade ceph-resource-agentsUpgrade ceph-test-debuginfoUpgrade ceph-mds-debuginfoUpgrade ceph-osd-debuginfoUpgrade python3-radosUpgrade ceph-debuginfoUpgrade ceph-immutable-object-cacheUpgrade ansible-collection-ansible-posixUpgrade libradosstriper1Upgrade ceph-selinuxUpgrade cephfs-mirror-debuginfoUpgrade rbd-fuse-debuginfoUpgrade ceph-mibUpgrade librbd-develUpgrade ceph-exporter-debuginfoUpgrade rbd-mirror-debuginfoUpgrade ceph-fuseUpgrade cephadmUpgrade ceph-common-debuginfo | Jun 16, 2023 | Jul 6, 2022 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.0.6Upgrade Splunk Enterprise to version 8.2.12Upgrade Splunk Enterprise to version 8.1.14Upgrade Splunk Enterprise to version 9.1.1Upgrade Splunk Enterprise to version 8.2.11Upgrade Splunk Enterprise to version 9.0.5Upgrade Splunk Enterprise to version 9.0.4Upgrade Splunk Enterprise to version 8.1.13Upgrade Splunk Enterprise to version 8.2.10 | Sep 30, 2025 | Jul 6, 2022 |
| Ubuntu | — | Upgrade node-momentUpgrade libjs-momentUpgrade postfixadmin (Ubuntu Pro) | Aug 11, 2022 | Jul 6, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub