moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
Project Subscriptions
| Vendors | Products |
|---|---|
|
Debian
Subscribe
|
Debian Linux
Subscribe
|
|
Fedoraproject
Subscribe
|
Fedora
Subscribe
|
|
Momentjs
Subscribe
|
Moment
Subscribe
|
|
Redhat
Subscribe
|
Acm
Subscribe
Ceph Storage
Subscribe
Jboss Enterprise Bpms Platform
Subscribe
Jboss Fuse
Subscribe
Multicluster Engine
Subscribe
Openshift Data Foundation
Subscribe
Openshift Distributed Tracing
Subscribe
Red Hat Single Sign On
Subscribe
Rhev Hypervisor
Subscribe
Rhev Manager
Subscribe
Rhosemc
Subscribe
Service Mesh
Subscribe
Service Registry
Subscribe
Storage
Subscribe
|
Advisories
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-3295-1 | node-moment security update |
EUVD |
EUVD-2022-6433 | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input. |
Github GHSA |
GHSA-wc69-rhjr-hc9g | Moment.js vulnerable to Inefficient Regular Expression Complexity |
Ubuntu USN |
USN-5559-1 | Moment.js vulnerabilities |
Ubuntu USN |
USN-6550-1 | PostfixAdmin vulnerabilities |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Mon, 03 Nov 2025 22:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Tue, 22 Apr 2025 18:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Sun, 08 Sep 2024 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Redhat multicluster Engine
|
|
| CPEs | cpe:/a:redhat:acm:2.4::el8 cpe:/a:redhat:acm:2.5::el8 cpe:/a:redhat:acm:2.6::el8 cpe:/a:redhat:multicluster_engine:2.0::el8 cpe:/a:redhat:multicluster_engine:2.1::el8 |
|
| Vendors & Products |
Redhat multicluster Engine
|
Mon, 19 Aug 2024 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| CPEs | cpe:/a:redhat:acm:2.5::el8 cpe:/a:redhat:acm:2.6::el8 cpe:/a:redhat:multicluster_engine:2.0::el8 cpe:/a:redhat:multicluster_engine:2.1::el8 |
|
| Vendors & Products |
Redhat multicluster Engine
|
Projects
Sign in to view the affected projects.
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2025-11-03T21:46:17.025Z
Reserved: 2022-05-18T00:00:00.000Z
Link: CVE-2022-31129
Updated: 2025-11-03T21:46:17.025Z
Status : Modified
Published: 2022-07-06T18:15:19.570
Modified: 2025-11-03T22:15:58.440
Link: CVE-2022-31129
OpenCVE Enrichment
No data.
Debian DLA
EUVD
Github GHSA
Ubuntu USN