Path Traversal Vulnerability in Moment.js Affects Server-Side npm Users
CVE-2026-17495

5.9MEDIUM

Key Information:

Vendor

Moment

Status
Moment
Vendor
CVE Published:
15 September 2026

What is CVE-2026-17495?

A vulnerability in Moment.js allows attackers to exploit a path traversal issue when a non-string object is passed to the moment.locale() method. This could enable unauthorized access to the file system if user-provided input is not validated properly, particularly in server-side npm applications. Users are advised to upgrade to Moment.js version 2.31.0 or later to mitigate this issue. As a temporary measure, ensure that any input provided by users is strictly validated as a string before it reaches the moment.locale() method.

Affected Version(s)

moment 2.29.2 < 2.31.0

moment 2.31.0

References

https://github.com/moment/moment/security/advisories/GHSA...
https://cna.openjsf.org/security-advisories.html

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

zolbooo
UlisesGascon
gilmoreorless
mattjohnsonpint
.